Data processing and scanning systems for assessing vendor risk

ABSTRACT

Data processing systems and methods, according to various embodiments, are adapted for efficiently processing data to allow for the streamlined assessment of risk ratings for one or more vendors. In various embodiments, the systems/methods may use one or more particular vendor attributes (e.g., as determined from scanning one or more webpages associated with the particular vendor) and the contents of one or more completed privacy templates for the vendor to determine a vendor risk rating for the particular vendor. As a particular example, the system may scan a website associated with the vendor to automatically determine one or more security certifications associated with the vendor and use that information, along with information from a completed privacy template for the vendor, to calculate a vendor risk rating that indicates the risk of doing business with the vendor.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of U.S. patent applicationSer. No. 16/443,374, filed Jun. 17, 2019, which claims priority to U.S.Provisional Patent Application Ser. No. 62/685,684, filed Jun. 15, 2018,and is also a continuation-in-part of U.S. patent application Ser. No.16/241,710, filed Jan. 7, 2019, which is a continuation-in-part of U.S.patent application Ser. No. 16/226,280, filed Dec. 19, 2018, now U.S.Pat. No. 10,346,598, issued Jul. 9, 2019, which is a continuation ofU.S. patent application Ser. No. 15/989,416, filed May 25, 2018, nowU.S. Pat. No. 10,181,019, issued Jan. 15, 2019, which is acontinuation-in-part of U.S. patent application Ser. No. 15/853,674,filed Dec. 22, 2017, now U.S. Pat. No. 10,019,597, issued Jul. 10, 2018,which claims priority from U.S. Provisional Patent Application Ser. No.62/541,613, filed Aug. 4, 2017, and which is also a continuation-in-partof U.S. patent application Ser. No. 15/619,455, filed Jun. 10, 2017, nowU.S. Pat. No. 9,851,966, issued Dec. 26, 2017, which is acontinuation-in-part of U.S. patent application Ser. No. 15/254,901,filed Sep. 1, 2016, now U.S. Pat. No. 9,729,583, issued Aug. 8, 2017;which claims priority from: (1) U.S. Provisional Patent Application Ser.No. 62/360,123, filed Jul. 8, 2016; (2) U.S. Provisional PatentApplication Ser. No. 62/353,802, filed Jun. 23, 2016; and (3) U.S.Provisional Patent Application Ser. No. 62/348,695, filed Jun. 10, 2016.The disclosures of all of the above patent applications are herebyincorporated herein by reference in their entirety.

TECHNICAL FIELD

This disclosure relates to data processing systems and methods forretrieving data regarding one or more vendors, for using that data todetermine a risk rating associated with the vendor, and for performingone or more automated actions based on the vendor risk rating.

BACKGROUND

Over the past years, privacy and security policies, and relatedoperations have become increasingly important. Breaches in security,leading to the unauthorized access of personal data (which may includesensitive personal data) have become more frequent among companies andother organizations of all sizes. Such personal data may include, but isnot limited to, personally identifiable information (PII), which may beinformation that directly (or indirectly) identifies an individual orentity. Examples of PII include names, addresses, dates of birth, socialsecurity numbers, and biometric identifiers such as a person'sfingerprints or picture. Other personal data may include, for example,customers' Internet browsing habits, purchase history, or even theirpreferences (e.g., likes and dislikes, as provided or obtained throughsocial media).

Many organizations that obtain, use, and transfer personal data,including sensitive personal data, have begun to address these privacyand security issues. To manage personal data, many companies haveattempted to implement operational policies and processes that complywith legal requirements, such as Canada's Personal InformationProtection and Electronic Documents Act (PIPEDA) or the U.S.'s HealthInsurance Portability and Accountability Act (HIPPA) protecting apatient's medical information. Many regulators recommend conductingprivacy impact assessments, or data protection risk assessments alongwith data inventory mapping. For example, the GDPR requires dataprotection impact assessments. Additionally, the United Kingdom ICO'soffice provides guidance around privacy impact assessments. The OPC inCanada recommends certain personal information inventory practices, andthe Singapore PDPA specifically mentions personal data inventorymapping.

Many organizations have also begun to track the compliance of theirvendors with privacy laws, regulations, and/or standards. This can beexpensive and time consuming using traditional methods. Accordingly,there is a need for improved systems and methods for efficientlytracking the compliance of vendors with privacy laws, regulations,and/or standards, and for assessing the risk associated with doingbusiness with a particular vendor.

SUMMARY

A computer-implemented data processing method for performing a riskassessment for a vendor, according to various embodiments, comprises:(A) scanning, by one or more computer processors, one or more webpagesassociated with the vendor; (B) identifying, by one or more computerprocessors, one or more vendor attributes associated with the vendorbased on the scanned one or more webpages, wherein the one or morevendor attributes comprise one or more security certifications that thevendor holds; (C) accessing, by one or more computer processors, one ormore databases of security certifications to determine whether thevendor holds the one or more security certifications; (D) accessing, byone or more computer processors, a completed privacy template, thecompleted privacy template comprising a plurality of question/answerpairings regarding the vendor; (E) calculating, by one or more computerprocessors, a vendor risk rating based at least in part on the one ormore vendor attributes and content of the at least one of the pluralityof question/answer pairings in the completed privacy template; and (F)taking, by one or more computer processors, one or more automatedactions based on the calculated vendor risk rating.

A computer-implemented data processing method for performing a riskassessment for a vendor, according to various embodiments, comprises:(A) scanning, by one or more computer processors, one or more webpagesassociated with the vendor; (B) identifying, by one or more computerprocessors, one or more vendor attributes associated with the vendorbased on the scanned one or more webpages, wherein the one or morevendor attributes comprise one or more security policies implemented bythe vendor; (C) accessing, by one or more computer processors, acompleted privacy template, the completed privacy template comprising aplurality of question/answer pairings regarding the vendor; (D)calculating, by one or more computer processors, a vendor risk ratingbased at least in part on the one or more vendor attributes and contentof the at least one of the plurality of question/answer pairings in thecompleted privacy template; and (E) taking, by one or more computerprocessors, one or more automated actions based on the calculated vendorrisk rating.

A computer-implemented data-processing method for performing a riskassessment for a vendor used as part of a processing activity, accordingto further embodiments, comprises: (A) receiving, by one or morecomputer processors, a completed privacy template from a vendor, thecompleted privacy template comprising a plurality of question/answerpairings regarding a particular product or service provided by thevendor; (B) scanning, by one or more computer processors, one or morewebpages associated with the vendor; (C) identifying, by one or morecomputer processors, one or more vendor attributes associated with thevendor based on the scanned one or more webpages, wherein the one ormore vendor attributes comprise a privacy policy associated with the oneor more webpages; (D) analyzing, by one or more computer processors, theprivacy policy to identify one or more key terms in the privacy policyrelated to the particular product or service that is the subject of atleast one question within the privacy template; (E) calculating, by oneor more computer processors, a vendor risk rating for the vendor basedat least in part on the one or more vendor attributes, the one or morekey terms in the privacy policy, and one or more question/answerpairings from the privacy template; and (F) taking, by one or morecomputer processors, one or more automated actions based on thecalculated vendor risk rating.

The details of one or more embodiments of the subject matter describedin this specification are set forth in the accompanying drawings and thedescription below. Other features, aspects, and advantages of thesubject matter may become apparent from the description, the drawings,and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of a system and method for operationalizing privacycompliance and assessing risk of privacy campaigns are described below.In the course of this description, reference will be made to theaccompanying drawings, which are not necessarily drawn to scale, andwherein:

FIG. 1 is a diagram illustrating an exemplary network environment inwhich the present systems and methods for operationalizing privacycompliance may operate.

FIG. 2 is a schematic diagram of a computer (such as the server 120; oruser device 140, 150, 160, 170, 180, 190; and/or such as the vendor riskscanning server 1100, or one or more remote computing devices 1500) thatis suitable for use in various embodiments;

FIG. 3 is a diagram illustrating an example of the elements (e.g.,subjects, owner, etc.) that may be involved in privacy compliance.

FIG. 4 is a flow chart showing an example of a process performed by theMain Privacy Compliance Module.

FIG. 5 is a flow chart showing an example of a process performed by theRisk Assessment Module.

FIG. 6 is a flow chart showing an example of a process performed by thePrivacy Audit Module.

FIG. 7 is a flow chart showing an example of a process performed by theData Flow Diagram Module.

FIG. 8 is an example of a graphical user interface (GUI) showing adialog that allows for the entry of description information related to aprivacy campaign.

FIG. 9 is an example of a notification, generated by the system,informing a business representative (e.g., owner) that they have beenassigned to a particular privacy campaign.

FIG. 10 is an example of a GUI showing a dialog allowing entry of thetype of personal data that is being collected for a campaign.

FIG. 11 is an example of a GUI that shows a dialog that allowscollection of campaign data regarding the subject from which personaldata was collected.

FIG. 12 is an example of a GUI that shows a dialog for inputtinginformation regarding where the personal data related to a campaign isstored.

FIG. 13 is an example of a GUI that shows information regarding theaccess of personal data related to a campaign.

FIG. 14 is an example of an instant messaging session overlaid on top ofa GUI, wherein the GUI contains prompts for the entry or selection ofcampaign data.

FIG. 15 is an example of a GUI showing an inventory page.

FIG. 16 is an example of a GUI showing campaign data, including a dataflow diagram.

FIG. 17 is an example of a GUI showing a web page that allows editing ofcampaign data.

FIGS. 18A-18B depict a flow chart showing an example of a processperformed by the Data Privacy Compliance Module.

FIGS. 19A-19B depict a flow chart showing an example of a processperformed by the Privacy Assessment Report Module.

FIG. 20 is a flow chart showing an example of a process performed by thePrivacy Assessment Monitoring Module according to particularembodiments.

FIG. 21 is a flow chart showing an example of a process performed by thePrivacy Assessment Modification Module.

FIG. 22 depicts an exemplary vendor risk scanning system according toparticular embodiments.

DETAILED DESCRIPTION

Various embodiments now will be described more fully hereinafter withreference to the accompanying drawings. It should be understood that theinvention may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein. Rather, theseembodiments are provided so that this disclosure will be thorough andcomplete, and will fully convey the scope of the invention to thoseskilled in the art. Like numbers refer to like elements throughout.

Overview

According to exemplary embodiments, a system for operationalizingprivacy compliance is described herein. The system may be comprised ofone or more servers and client computing devices that execute softwaremodules that facilitate various functions.

A Main Privacy Compliance Module is operable to allow a user to initiatethe creation of a privacy campaign (i.e., a business function, system,product, technology, process, project, engagement, initiative, campaign,etc., that may utilize personal data collected from one or more personsor entities). The personal data may contain PII that may be sensitivepersonal data. The user can input information such as the name anddescription of the campaign. The user may also select whether he/shewill take ownership of the campaign (i.e., be responsible for providingthe information needed to create the campaign and oversee the conductingof privacy audits related to the campaign), or assign the campaign toone or more other persons. The Main Privacy Compliance Module cangenerate a sequence or serious of GUI windows that facilitate the entryof campaign data representative of attributes related to the privacycampaign (e.g., attributes that might relate to the description of thepersonal data, what personal data is collected, whom the data iscollected from, the storage of the data, and access to that data).

Based on the information input, a Risk Assessment Module may be operableto take into account Weighting Factors and Relative Risk Ratingsassociated with the campaign in order to calculate a numerical RiskLevel associated with the campaign, as well as an Overall RiskAssessment for the campaign (i.e., low-risk, medium risk, or high risk).The Risk Level may be indicative of the likelihood of a breach involvingpersonal data related to the campaign being compromised (i.e., lost,stolen, accessed without authorization, inadvertently disclosed,maliciously disclosed, etc.). An inventory page can visually depict theRisk Level for one or more privacy campaigns.

After the Risk Assessment Module has determined a Risk Level for acampaign, a Privacy Audit Module may be operable to use the Risk Levelto determine an audit schedule for the campaign. The audit schedule maybe editable, and the Privacy Audit Module also facilitates the privacyaudit process by sending alerts when a privacy audit is impending, orsending alerts when a privacy audit is overdue.

The system may also include a Data Flow Diagram Module for generating adata flow diagram associated with a campaign. An exemplary data flowdiagram displays one or more shapes representing the source from whichdata associated with the campaign is derived, the destination (orlocation) of that data, and which departments or software systems mayhave access to the data. The Data Flow Diagram Module may also generateone or more security indicators for display. The indicators may include,for example, an “eye” icon to indicate that the data is confidential, a“lock” icon to indicate that the data, and/or a particular flow of data,is encrypted, or an “unlocked lock” icon to indicate that the data,and/or a particular flow of data, is not encrypted. Data flow lines maybe colored differently to indicate whether the data flow is encrypted orunencrypted.

The system also provides for a Communications Module that facilitatesthe creation and transmission of notifications and alerts (e.g., viaemail). The Communications Module may also instantiate an instantmessaging session and overlay the instant messaging session over one ormore portions of a GUI in which a user is presented with prompts toenter or select information.

In particularly embodiments, a vendor risk scanning system is configuredto scan one or more webpages associated with a particular vendor (e.g.,provider of particular software, particular entity, etc.) in order toidentify one or more vendor attributes. In particular embodiments, thesystem may be configured to scan the one or more web pages to identifyone or more vendor attributes such as, for example: (1) one or moresecurity certifications that the vendor does or does not have (e.g., ISO27001, SOC II Type 2, etc.); (2) one or more awards and/or recognitionsthat the vendor has received (e.g., one or more security awards); (3)one or more security policies and/or 3^(rd) party vendor parties; (4)one or more privacy policies and/or cookie policies for the one or morewebpages; (5) one or more key partners or potential sub processors ofone or more services associated with the vendor; and/or (6) any othersuitable vendor attribute. Other suitable vendor attributes may include,for example, membership in a Privacy Shield, use of StandardizedInformation Gathering (SIG), etc.

In various embodiments, the system is configured to scan the one or morewebpages by: (1) scanning one or more pieces of computer code associatedwith the one or more webpages (e.g., HTML, Java, etc.); (2) scanning oneor more contents of the one or more webpages (e.g., using one or morenatural language processing techniques); (3) scanning for one or moreparticular images on the one or more webpages (e.g., one or more imagesthat indicate membership in a particular organization, receipt of aparticular award etc.; and/or (4) using any other suitable scanningtechnique. The system may, for example, identify one or more image hostsof one or more images identified on the website, analyze the contents ofa particular identified privacy or cookie policy that is displayed onthe one or more webpages, etc. The system may, for example, beconfigured to automatically detect the one or more vendor attributesdescribed above.

In various embodiments, the system may, for example: (1) analyze the oneor more vendor attributes; and (2) calculate a risk rating for thevendor based at least in part on the one or more vendor attributes. Inparticular embodiments, the system is configured to automatically assigna suitable weighting factor to each of the one or more vendor attributeswhen calculating the risk rating. In particular embodiments, the systemis configured to analyze one or more pieces of the vendor's publishedapplications of software available to one or more customers for downloadvia the one or more webpages to detect one or more privacy disclaimersassociated with the published applications. The system may then, forexample, be configured to use one or more text matching techniques todetermine whether the one or more privacy disclaimers contain one ormore pieces of language required by one or more prevailing industry orlegal requirements related to data privacy. The system may, for example,be configured to assign a relatively low risk score to a vendor whosesoftware (e.g., and/or webpages) includes required privacy disclaimers,and configured to assign a relatively high risk score to a vendor whoseone or more webpages do not include such disclaimers.

In another example, the system may be configured to analyze one or morewebsites associated with a particular vendor for one or more privacynotices, one or more blog posts, one or more preference centers, and/orone or more control centers. The system may, for example, calculate thevendor risk score (also referred to as a vendor risk rating) based atleast in part on a presence of one or more suitable privacy notices, oneor more contents of one or more blog posts on the vendor site (e.g.,whether the vendor sire has one or more blog posts directed toward userprivacy), a presence of one or more preference or control centers thatenable visitors to the site to opt in or out of certain data collectionpolicies (e.g., cookie policies, etc.), etc.

In particular other embodiments, the system may be configured toautomatically determine whether the particular vendor holds one or moresecurity certifications. The one or more security certifications mayinclude, for example: (1) system and organization control (SOC); (2)International Organization for Standardization (ISO); (3) HealthInsurance Portability and Accountability ACT (HIPPA); (4) etc. Invarious embodiments, the system is configured to access one or morepublic databases of security certifications to determine whether theparticular vendor holds any particular certification. The system maythen determine a privacy awareness score and/or vendor risk rating forthe vendor based on whether the vendor holds one or more securitycertifications (e.g., the system may calculate a relatively higherprivacy awareness score, or lower vendor risk rating for the vendor ifthe vendor holds one or more particular security certifications). Invarious embodiments, the system may be configured to determine whether avendor has one or more particular security certifications by scanning avendor web site for an indication of the one or more securitycertifications. The system may, for example, be configured to determinethat a vendor has a particular security certification in response toidentifying one or more particular images associated with a particularcertification (e.g., a brand and/or logo associated with thecertification) during a scan of the vendor's website.

In particular embodiments, the system is configured to analyze one ormore social networking sites (e.g., LinkedIn, Facebook, etc.) and/or oneor more business related job sites (e.g., one or more job-posting sites,one or more corporate websites, etc.) or other third-party websites thatare associated with the vendor (e.g., but not maintained by the vendor).The system may, for example, use social networking and other data toidentify one or more employee titles of the vendor, one or more jobroles for one or more employees of the vendor, one or more job postingsfor the vendor, etc. The system may then analyze the one or more jobtitles, postings, listings, and/or roles, etc. to determine whether thevendor has or is seeking one or more employees that have a roleassociated with data privacy or other privacy concerns. In this way, thesystem may determine whether the vendor is particularly focused onprivacy or other related activities. The system may then calculate aprivacy awareness score and/or risk rating for the vendor based on sucha determination (e.g., a vendor that has, or is seeking, one or moreemployees whose roles or titles are related to privacy may receive arelatively higher privacy awareness score than those who don't).

In particular embodiments, the system may be configured to calculate theprivacy awareness score and/or risk rating for the vendor using one ormore additional factors such as, for example: (1) public informationassociated with one or more events that the vendor is attending; (2)public information associated with one or more conferences that thevendor has participated in or is planning to participate in; (3) etc. Insome embodiments, the system may calculate a privacy awareness score orrisk rating for the vendor based at least in part on one or moregovernment relationships with the vendor. For example, the system may beconfigured to calculate a relatively high privacy awareness score (orrelative low risk rating) for a vendor that has one or more contractswith one or more government entities (e.g., because an existence of sucha contract may indicate that the vendor has passed one or more vettingrequirements imposed by the one or more government entities).

In any embodiment described herein, the system may be configured toassign, identify, and/or determine a weighting factor for each of aplurality of factors used to determine a risk rating score for aparticular vendor. For example, when calculating the rating, the systemmay assign a first weighting factor to a first particular vendorattribute (e.g., whether the vendor has one or more suitable privacynotices posted on the vendor website), a second weighting factor to asecond particular vendor attribute (e.g., whether the vendor has one ormore particular security certifications), etc. The system may, forexample, assign one or more weighting factors using any suitabletechnique described herein with relation to risk rating determination.In some embodiments, the system may be configured to receive the one ormore weighting factors (e.g., from a user). In other embodiments, thesystem may be configured to determine the one or more weighting factorsbased at least in part on a type of the factor.

In any embodiment described herein, the system may be configured todetermine an overall risk rating for a particular vendor (e.g., a riskrating associated with sharing sensitive information with the vendorand/or a risk rating associated with a particular piece of vendorsoftware) based at least in part on the privacy awareness score. Inparticular embodiments, the system may be configured to determine anoverall risk rating for a particular vendor based, at least in part, onthe vendor's privacy awareness score in combination with, or not incombination with, one or more additional factors (e.g., one or morevendor attributes not taken into account when determining the privacyawareness score and/or any other suitable information regarding thevendor described herein). In any such embodiment, the system may assignone or more weighting factors and/or relative risk ratings to each ofthe privacy awareness score and other risk factors when calculating anoverall risk rating. The system may then be configured to provide therisk score for the vendor, software, and/or service for use incalculating a risk of undertaking a particular processing activity thatutilizes the vendor, software, and/or service (e.g., in any suitablemanner described herein).

In a particular example, the system may be configured to identifywhether the vendor is part of a Privacy Shield arrangement and use thatinformation in determining a privacy awareness score and/or vendor riskrating for the vendor. In particular, a privacy shield arrangement mayfacilitate monitoring of an entity's compliance with one or morecommitments and enforcement of those commitments under the privacyshield. In particular, an entity entering a privacy shield arrangementmay, for example: (1) be obligated to publicly commit to robustprotection of any personal data that it handles; (2) be required toestablish a clear set of safeguards and transparency mechanisms on whocan access the personal data it handles; and/or (3) be required toestablish a redress right to address complaints about improper access tothe personal data.

In a particular example of a privacy shield, a privacy shield betweenthe United States and Europe may involve, for example: (1) establishmentof responsibility by the U.S. Department of Commerce to monitor anentity's compliance (e.g., a company's compliance) with its commitmentsunder the privacy shield; and (2) establishment of responsibility of theFederal Trade Commission having enforcement authority over thecommitments. In a further example, the U.S. Department of Commerce maydesignate an ombudsman to hear complaints from Europeans regarding U.S.surveillance that affects personal data of Europeans.

In some embodiments, the one or more regulations may include aregulation that allows data transfer to a country or entity thatparticipates in a safe harbor and/or privacy shield as discussed herein.The system may, for example, be configured to automatically identify atransfer that is subject to a privacy shield and/or safe harbor as ‘lowrisk.’ In this example, U.S. Privacy Shield members may be maintained ina database of privacy shield members (e.g., on one or more particularwebpages such as at www.privacyshield.gov). The system may be configuredto scan such webpages to identify whether the vendor is part of theprivacy shield.

In particular embodiments, the system may be configured to monitor theone or more websites (e.g., one or more webpages) to identify one ormore changes to the one or more vendor attributes. For example, a vendormay update a privacy policy for the website (e.g., to comply with one ormore legal or policy changes). In some embodiments, a change in aprivacy policy may modify a relationship between a website and itsusers. In such embodiments, the system may be configured to: (1)determine that a particular website has changed its privacy policy; and(2) perform a new scan of the website in response to determining thechange. The system may, for example, scan a website's privacy policy ata first time and a second time to determine whether a change hasoccurred. The system may be configured to analyze the change in privacypolicy to determine whether to modify the calculated risk rating for thevendor (e.g., based on the change).

The system may, for example, be configured to continuously monitor forone or more changes. In other embodiments, the system may be configuredto scan for one or more changes according to a particular schedule(e.g., hourly, daily, weekly, or any other suitable schedule.). Forexample, the system may be configured to scan the one or more webpageson an ongoing basis to determine whether the one or more vendorattributes have changed (e.g., the vendor did not renew its PrivacyShield membership, lost its ISO certification, etc.).

Exemplary Technical Platforms

As will be appreciated by one skilled in the relevant field, a systemfor operationalizing privacy compliance and assessing risk of privacycampaigns may be, for example, embodied as a computer system, a method,or a computer program product. Accordingly, various embodiments may takethe form of an entirely hardware embodiment, an entirely softwareembodiment, or an embodiment combining software and hardware aspects.Furthermore, particular embodiments may take the form of a computerprogram product stored on a computer-readable storage medium havingcomputer-readable instructions (e.g., software) embodied in the storagemedium. Various embodiments may take the form of web, mobile, wearablecomputer-implemented, computer software. Any suitable computer-readablestorage medium may be utilized including, for example, hard disks,compact disks, DVDs, optical storage devices, and/or magnetic storagedevices.

Various embodiments are described below with reference to block diagramsand flowchart illustrations of methods, apparatuses (e.g., systems) andcomputer program products. It should be understood that each step of theblock diagrams and flowchart illustrations, and combinations of steps inthe block diagrams and flowchart illustrations, respectively, may beimplemented by a computer executing computer program instructions. Thesecomputer program instructions may be loaded onto a general purposecomputer, special purpose computer, or other programmable dataprocessing apparatus to produce a machine, such that the instructionswhich execute on the computer or other programmable data processingapparatus to create means for implementing the functions specified inthe flowchart step or steps

These computer program instructions may also be stored in acomputer-readable memory that may direct a computer or otherprogrammable data processing apparatus to function in a particularmanner such that the instructions stored in the computer-readable memoryproduce an article of manufacture that is configured for implementingthe function specified in the flowchart step or steps. The computerprogram instructions may also be loaded onto a computer or otherprogrammable data processing apparatus to cause a series of operationalsteps to be performed on the computer or other programmable apparatus toproduce a computer implemented process such that the instructions thatexecute on the computer or other programmable apparatus provide stepsfor implementing the functions specified in the flowchart step or steps.

Accordingly, steps of the block diagrams and flowchart illustrationssupport combinations of mechanisms for performing the specifiedfunctions, combinations of steps for performing the specified functions,and program instructions for performing the specified functions. Itshould also be understood that each step of the block diagrams andflowchart illustrations, and combinations of steps in the block diagramsand flowchart illustrations, may be implemented by special purposehardware -based computer systems that perform the specified functions orsteps, or combinations of special purpose hardware and other hardwareexecuting appropriate computer instructions.

Example System Architecture

FIG. 1 is a block diagram of a System 100 according to a particularembodiment. As may be understood from this figure, the System 100includes one or more computer networks 110, a Server 120, a StorageDevice 130 (which may contain one or more databases of information), oneor more remote client computing devices such as a tablet computer 140, adesktop or laptop computer 150, or a handheld computing device 160, suchas a cellular phone, browser and Internet capable set-top boxes 170connected with a TV 180, or even smart TVs 180 having browser andInternet capability. The client computing devices attached to thenetwork may also include copiers/printers 190 having hard drives (asecurity risk since copies/prints may be stored on these hard drives).The Server 120, client computing devices, and Storage Device 130 may bephysically located in a central location, such as the headquarters ofthe organization, for example, or in separate facilities. The devicesmay be owned or maintained by employees, contractors, or other thirdparties (e.g., a cloud service provider). In particular embodiments, theone or more computer networks 115 facilitate communication between theServer 120, one or more client computing devices 140, 150, 160, 170,180, 190, and Storage Device 130.

The one or more computer networks 115 may include any of a variety oftypes of wired or wireless computer networks such as the Internet, aprivate intranet, a public switched telephone network (PSTN), or anyother type of network. The communication link between the Server 120,one or more client computing devices 140, 150, 160, 170, 180, 190, andStorage Device 130 may be, for example, implemented via a Local AreaNetwork (LAN) or via the Internet.

Example Computer Architecture Used Within the System

FIG. 2 illustrates a diagrammatic representation of the architecture ofa computer 200 that may be used within the System 100, for example, as aclient computer (e.g., one of computing devices 140, 150, 160, 170, 180,190, shown in FIG. 1), or as a server computer (e.g., Server 120 shownin FIG. 1). In exemplary embodiments, the computer 200 may be suitablefor use as a computer within the context of the System 100 that isconfigured to operationalize privacy compliance and assess risk ofprivacy campaigns. In particular embodiments, the computer 200 may beconnected (e.g., networked) to other computers in a LAN, an intranet, anextranet, and/or the Internet. As noted above, the computer 200 mayoperate in the capacity of a server or a client computer in aclient-server network environment, or as a peer computer in apeer-to-peer (or distributed) network environment. The computer 200 maybe a personal computer (PC), a tablet PC, a set-top box (STB), aPersonal Digital Assistant (PDA), a cellular telephone, a web appliance,a server, a network router, a switch or bridge, or any other computercapable of executing a set of instructions (sequential or otherwise)that specify actions to be taken by that computer. Further, while only asingle computer is illustrated, the term “computer” shall also be takento include any collection of computers that individually or jointlyexecute a set (or multiple sets) of instructions to perform any one ormore of the methodologies discussed herein.

An exemplary computer 200 includes a processing device 202, a mainmemory 204 (e.g., read-only memory (ROM), flash memory, dynamic randomaccess memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM(RDRAM), etc.), a static memory 206 (e.g., flash memory, static randomaccess memory (SRAM), etc.), and a data storage device 218, whichcommunicate with each other via a bus 232.

The processing device 202 represents one or more general-purposeprocessing devices such as a microprocessor, a central processing unit,or the like. More particularly, the processing device 202 may be acomplex instruction set computing (CISC) microprocessor, reducedinstruction set computing (RISC) microprocessor, very long instructionword (VLIW) microprocessor, or processor implementing other instructionsets, or processors implementing a combination of instruction sets. Theprocessing device 202 may also be one or more special-purpose processingdevices such as an application specific integrated circuit (ASIC), afield programmable gate array (FPGA), a digital signal processor (DSP),network processor, or the like. The processing device 202 may beconfigured to execute processing logic 226 for performing variousoperations and steps discussed herein.

The computer 200 may further include a network interface device 208. Thecomputer 200 also may include a video display unit 210 (e.g., a liquidcrystal display (LCD) or a cathode ray tube (CRT)), an alphanumericinput device 212 (e.g., a keyboard), a cursor control device 214 (e.g.,a mouse), and a signal generation device 216 (e.g., a speaker). The datastorage device 218 may include a non-transitory computer-readablestorage medium 230 (also known as a non-transitory computer-readablestorage medium or a non-transitory computer-readable medium) on which isstored one or more sets of instructions 222 (e.g., software, softwaremodules) embodying any one or more of the methodologies or functionsdescribed herein. The software 222 may also reside, completely or atleast partially, within main memory 204 and/or within processing device202 during execution thereof by computer 200—main memory 204 andprocessing device 202 also constituting computer-accessible storagemedia. The software 222 may further be transmitted or received over anetwork 220 via network interface device 208.

While the computer-readable storage medium 230 is shown in an exemplaryembodiment to be a single medium, the terms “computer-readable storagemedium” and “machine-accessible storage medium” should be understood toinclude a single medium or multiple media (e.g., a centralized ordistributed database, and/or associated caches and servers) that storethe one or more sets of instructions. The term “computer-readablestorage medium” should also be understood to include any medium that iscapable of storing, encoding or carrying a set of instructions forexecution by the computer and that cause the computer to perform any oneor more of the methodologies of the present invention. The term“computer-readable storage medium” should accordingly be understood toinclude, but not be limited to, solid-state memories, optical andmagnetic media, etc.

Exemplary System Platform

According to various embodiments, the processes and logic flowsdescribed in this specification may be performed by a system (e.g.,System 100) that includes, but is not limited to, one or moreprogrammable processors (e.g., processor 202) executing one or morecomputer program modules to perform functions by operating on input dataand generating output, thereby tying the process to a particular machine(e.g., a machine programmed to perform the processes described herein).This includes processors located in one or more of client computers(e.g., client computers 140, 150, 160, 170, 180, 190 of FIG. 1). Thesedevices connected to network 110 may access and execute one or moreInternet browser-based program modules that are “served up” through thenetwork 110 by one or more servers (e.g., server 120 of FIG. 1), and thedata associated with the program may be stored on a one or more storagedevices, which may reside within a server or computing device (e.g.,Main Memory 204, Static Memory 206), be attached as a peripheral storagedevice to the one or more servers or computing devices, or attached tothe network (e.g., Storage 130).

The System 100 facilitates the acquisition, storage, maintenance, use,and retention of campaign data associated with a plurality of privacycampaigns within an organization. In doing so, various aspects of theSystem 100 initiates and creates a plurality of individual data privacycampaign records that are associated with a variety of privacy-relatedattributes and assessment related meta-data for each campaign. Thesedata elements may include: the subjects of the sensitive information,the respective person or entity responsible for each campaign (e.g., thecampaign's “owner”), the location where the personal data will bestored, the entity or entities that will access the data, the parametersaccording to which the personal data will be used and retained, the RiskLevel associated with a particular campaign (as well as assessments fromwhich the Risk Level is calculated), an audit schedule, and otherattributes and meta-data. The System 100 may also be adapted tofacilitate the setup and auditing of each privacy campaign. Thesemodules may include, for example, a Main Privacy Compliance Module, aRisk Assessment Module, a Privacy Audit Module, a Data Flow DiagramModule, a Communications Module (examples of which are described below),a Privacy Assessment Monitoring Module, and a Privacy AssessmentModification Module. It is to be understood that these are examples ofmodules of various embodiments, but the functionalities performed byeach module as described may be performed by more (or less) modules.Further, the functionalities described as being performed by one modulemay be performed by one or more other modules.

A. Example Elements Related to Privacy Campaigns

FIG. 3 provides a high-level visual overview of example “subjects” forparticular data privacy campaigns, exemplary campaign “owners,” variouselements related to the storage and access of personal data, andelements related to the use and retention of the personal data. Each ofthese elements may, in various embodiments, be accounted for by theSystem 100 as it facilitates the implementation of an organization'sprivacy compliance policy.

As may be understood from FIG. 3, sensitive information may be collectedby an organization from one or more subjects 300. Subjects may includecustomers whose information has been obtained by the organization. Forexample, if the organization is selling goods to a customer, theorganization may have been provided with a customer's credit card orbanking information (e.g., account number, bank routing number), socialsecurity number, or other sensitive information.

An organization may also possess personal data originating from one ormore of its business partners. Examples of business partners are vendorsthat may be data controllers or data processors (which have differentlegal obligations under EU data protection laws). Vendors may supply acomponent or raw material to the organization, or an outside contractorresponsible for the marketing or legal work of the organization. Thepersonal data acquired from the partner may be that of the partners, oreven that of other entities collected by the partners. For example, amarketing agency may collect personal data on behalf of theorganization, and transfer that information to the organization.Moreover, the organization may share personal data with one of itspartners. For example, the organization may provide a marketing agencywith the personal data of its customers so that it may conduct furtherresearch.

Other subjects 300 include the organization's own employees.Organizations with employees often collect personal data from theiremployees, including address and social security information, usuallyfor payroll purposes, or even prior to employment, for conducting creditchecks. The subjects 300 may also include minors. It is noted thatvarious corporate privacy policies or privacy laws may require thatorganizations take additional steps to protect the sensitive privacy ofminors.

Still referring to FIG. 3, within an organization, a particularindividual (or groups of individuals) may be designated to be an “owner”of a particular campaign to obtain and manage personal data. Theseowners 310 may have any suitable role within the organization. Invarious embodiments, an owner of a particular campaign will have primaryresponsibility for the campaign, and will serve as a resident expertregarding the personal data obtained through the campaign, and the waythat the data is obtained, stored, and accessed. As shown in FIG. 3, anowner may be a member of any suitable department, including theorganization's marketing, HR, R&D, or IT department. As will bedescribed below, in exemplary embodiments, the owner can always bechanged, and owners can sub-assign other owners (and othercollaborators) to individual sections of campaign data input andoperations.

Referring still to FIG. 3, the system may be configured to account forthe use and retention 315 of personal data obtained in each particularcampaign. The use and retention of personal data may include how thedata is analyzed and used within the organization's operations, whetherthe data is backed up, and which parties within the organization aresupporting the campaign.

The system may also be configured to help manage the storage and access320 of personal data. As shown in FIG. 3, a variety of different partiesmay access the data, and the data may be stored in any of a variety ofdifferent locations, including on-site, or in “the cloud”, i.e., onremote servers that are accessed via the Internet or other suitablenetwork.

B. Main Compliance Module

FIG. 4 illustrates an exemplary process for operationalizing privacycompliance. Main Privacy Compliance Module 400, which may be executed byone or more computing devices of System 100, may perform this process.In exemplary embodiments, a server (e.g., server 140) in conjunctionwith a client computing device having a browser, execute the MainPrivacy Compliance Module (e.g., computing devices 140, 150, 160, 170,180, 190) through a network (network 110). In various exemplaryembodiments, the Main Privacy Compliance Module 400 may call upon othermodules to perform certain functions. In exemplary embodiments, thesoftware may also be organized as a single module to perform variouscomputer executable routines.

I. Adding a Campaign

The process 400 may begin at step 405, wherein the Main PrivacyCompliance Module 400 of the System 100 receives a command to add aprivacy campaign. In exemplary embodiments, the user selects anon-screen button (e.g., the Add Data Flow button 1555 of FIG. 15) thatthe Main Privacy Compliance Module 400 displays on a landing page, whichmay be displayed in a graphical user interface (GUI), such as a window,dialog box, or the like. The landing page may be, for example, theinventory page 1500 below. The inventory page 1500 may display a list ofone or more privacy campaigns that have already been input into theSystem 100. As mentioned above, a privacy campaign may represent, forexample, a business operation that the organization is engaged in, orsome business record, that may require the use of personal data, whichmay include the personal data of a customer or some other entity.Examples of campaigns might include, for example, Internet UsageHistory, Customer Payment Information, Call History Log, CellularRoaming Records, etc. For the campaign “Internet Usage History,” amarketing department may need customers' on-line browsing patterns torun analytics. This might entail retrieving and storing customers' IPaddresses, MAC address, URL history, subscriber ID, and otherinformation that may be considered personal data (and even sensitivepersonal data). As will be described herein, the System 100, through theuse of one or more modules, including the Main Privacy Campaign Module400, creates a record for each campaign. Data elements of campaign datamay be associated with each campaign record that represents attributessuch as: the type of personal data associated with the campaign; thesubjects having access to the personal data; the person or personswithin the company that take ownership (e.g., business owner) forensuring privacy compliance for the personal data associated with eachcampaign; the location of the personal data; the entities having accessto the data; the various computer systems and software applications thatuse the personal data; and the Risk Level (see below) associated withthe campaign.

II. Entry of Privacy Campaign Related Information, Including Owner

At step 410, in response to the receipt of the user's command to add aprivacy campaign record, the Main Privacy Compliance Module 400initiates a routine to create an electronic record for a privacycampaign, and a routine for the entry data inputs of information relatedto the privacy campaign. The Main Privacy Compliance Module 400 maygenerate one or more graphical user interfaces (e.g., windows, dialogpages, etc.), which may be presented one GUI at a time. Each GUI mayshow prompts, editable entry fields, check boxes, radial selectors,etc., where a user may enter or select privacy campaign data. Inexemplary embodiments, the Main Privacy Compliance Module 400 displayson the graphical user interface a prompt to create an electronic recordfor the privacy campaign. A user may choose to add a campaign, in whichcase the Main Privacy Compliance Module 400 receives a command to createthe electronic record for the privacy campaign, and in response to thecommand, creates a record for the campaign and digitally stores therecord for the campaign. The record for the campaign may be stored in,for example, storage 130, or a storage device associated with the MainPrivacy Compliance Module (e.g., a hard drive residing on Server 110, ora peripheral hard drive attached to Server 110).

The user may be a person who works in the Chief Privacy Officer'sorganization (e.g., a privacy office rep, or privacy officer). Theprivacy officer may be the user that creates the campaign record, andenters initial portions of campaign data (e.g., “high level” datarelated to the campaign), for example, a name for the privacy campaign,a description of the campaign, and a business group responsible foradministering the privacy operations related to that campaign (forexample, though the GUI shown in FIG. 6). The Main Privacy ComplianceModule 400 may also prompt the user to enter a person or entityresponsible for each campaign (e.g., the campaign's “owner”). The ownermay be tasked with the responsibility for ensuring or attempting toensure that the privacy policies or privacy laws associated withpersonal data related to a particular privacy campaign are beingcomplied with. In exemplary embodiments, the default owner of thecampaign may be the person who initiated the creation of the privacycampaign. That owner may be a person who works in the Chief PrivacyOfficer's organization (e.g., a privacy office rep, or privacy officer).The initial owner of the campaign may designate someone else to be theowner of the campaign. The designee may be, for example, arepresentative of some business unit within the organization (a businessrep). Additionally, more than one owner may be assigned. For example,the user may assign a primary business rep, and may also assign aprivacy office rep as owners of the campaign.

In many instances, some or most of the required information related tothe privacy campaign record might not be within the knowledge of thedefault owner (i.e., the privacy office rep). The Main Data ComplianceModule 400 can be operable to allow the creator of the campaign record(e.g., a privacy officer rep) to designate one or more othercollaborators to provide at least one of the data inputs for thecampaign data. Different collaborators, which may include the one ormore owners, may be assigned to different questions, or to specificquestions within the context of the privacy campaign. Additionally,different collaborators may be designated to respond to pats ofquestions. Thus, portions of campaign data may be assigned to differentindividuals.

Still referring to FIG. 4, if at step 415 the Main Privacy ComplianceModule 400 has received an input from a user to designate a new ownerfor the privacy campaign that was created, then at step 420, the MainPrivacy Compliance Module 400 may notify that individual via a suitablenotification that the privacy campaign has been assigned to him or her.Prior to notification, the Main Privacy Compliance Module 400 maydisplay a field that allows the creator of the campaign to add apersonalized message to the newly assigned owner of the campaign to beincluded with that notification. In exemplary embodiments, thenotification may be in the form of an email message. The email mayinclude the personalized message from the assignor, a standard messagethat the campaign has been assigned to him/her, the deadline forcompleting the campaign entry, and instructions to log in to the systemto complete the privacy campaign entry (along with a hyperlink thattakes the user to a GUI providing access to the Main Privacy ComplianceModule 400. Also included may be an option to reply to the email if anassigned owner has any questions, or a button that when clicked on,opens up a chat window (i.e., instant messenger window) to allow thenewly assigned owner and the assignor a GUI in which they are able tocommunicate in real-time. An example of such a notification appears inFIG. 16 below. In addition to owners, collaborators that are assigned toinput portions of campaign data may also be notified through similarprocesses. In exemplary embodiments, The Main Privacy Compliance Module400 may, for example through a Communications Module, be operable tosend collaborators emails regarding their assignment of one or moreportions of inputs to campaign data. Or through the CommunicationsModule, selecting the commentators button brings up one or morecollaborators that are on-line (with the off-line users still able tosee the messages when they are back on-line. Alerts indicate that one ormore emails or instant messages await a collaborator.

At step 425, regardless of whether the owner is the user (i.e., thecreator of the campaign), “someone else” assigned by the user, or othercollaborators that may be designated with the task of providing one ormore items of campaign data, the Main Privacy Campaign Module 400 may beoperable to electronically receive campaign data inputs from one or moreusers related to the personal data related to a privacy campaign througha series of displayed computer-generated graphical user interfacesdisplaying a plurality of prompts for the data inputs. In exemplaryembodiments, through a step-by-step process, the Main Privacy CampaignModule may receive from one or more users' data inputs that includecampaign data like: (1) a description of the campaign; (2) one or moretypes of personal data to be collected and stored as part of thecampaign; (3) individuals from which the personal data is to becollected; (4) the storage location of the personal data, and (5)information regarding who will have access to the personal data. Theseinputs may be obtained, for example, through the graphical userinterfaces shown in FIGS. 8 through 13, wherein the Main ComplianceModule 400 presents on sequentially appearing GUIs the prompts for theentry of each of the enumerated campaign data above. The Main ComplianceModule 400 may process the campaign data by electronically associatingthe campaign data with the record for the campaign and digitally storingthe campaign data with the record for the campaign. The campaign datamay be digitally stored as data elements in a database residing in amemory location in the server 120, a peripheral storage device attachedto the server, or one or more storage devices connected to the network(e.g., storage 130). If campaign data inputs have been assigned to oneor more collaborators, but those collaborators have not input the datayet, the Main Compliance Module 400 may, for example through theCommunications Module, sent an electronic message (such as an email)alerting the collaborators and owners that they have not yet suppliedtheir designated portion of campaign data.

III. Privacy Campaign Information Display

At step 430, Main Privacy Compliance Module 400 may, in exemplaryembodiments, call upon a Risk Assessment Module 430 that may determineand assign a Risk Level for the privacy campaign, based wholly or inpart on the information that the owner(s) have input. The RiskAssessment Module 430 will be discussed in more detail below.

At step 432, Main Privacy Compliance Module 400 may in exemplaryembodiments, call upon a Privacy Audit Module 432 that may determine anaudit schedule for each privacy campaign, based, for example, wholly orin part on the campaign data that the owner(s) have input, the RiskLevel assigned to a campaign, and/or any other suitable factors. ThePrivacy Audit Module 432 may also be operable to display the status ofan audit for each privacy campaign. The Privacy Audit Module 432 will bediscussed in more detail below.

At step 435, the Main Privacy Compliance Module 400 may generate anddisplay a GUI showing an inventory page (e.g., inventory page 1500) thatincludes information associated with each campaign. That information mayinclude information input by a user (e.g., one or more owners), orinformation calculated by the Main Privacy Compliance Module 400 orother modules. Such information may include for example, the name of thecampaign, the status of the campaign, the source of the campaign, thestorage location of the personal data related to the campaign, etc. Theinventory page 1500 may also display an indicator representing the RiskLevel (as mentioned, determined for each campaign by the Risk AssessmentModule 430), and audit information related to the campaign that wasdetermined by the Privacy Audit Module (see below). The inventory page1500 may be the landing page displayed to users that access the system.Based on the login information received from the user, the Main PrivacyCompliance Module may determine which campaigns and campaign data theuser is authorized to view, and display only the information that theuser is authorized to view. Also from the inventory page 1500, a usermay add a campaign (discussed above in step 405), view more informationfor a campaign, or edit information related to a campaign (see, e.g.,FIGS. 15, 16, 17).

If other commands from the inventory page are received (e.g., add acampaign, view more information, edit information related to thecampaign), then step 440, 445, and/or 450 may be executed.

At step 440, if a command to view more information has been received ordetected, then at step 445, the Main Privacy Compliance Module 400 maypresent more information about the campaign, for example, on a suitablecampaign information page 1500. At this step, the Main PrivacyCompliance Module 400 may invoke a Data Flow Diagram Module (describedin more detail below). The Data Flow Diagram Module may generate a flowdiagram that shows, for example, visual indicators indicating whetherdata is confidential and/or encrypted (see, e.g., FIG. 1600 below).

At step 450, if the system has received a request to edit a campaign,then, at step 455, the system may display a dialog page that allows auser to edit information regarding the campaign (e.g., edit campaigndialog 1700).

At step 460, if the system has received a request to add a campaign, theprocess may proceed back to step 405.

C. Risk Assessment Module

FIG. 5 illustrates an exemplary process for determining a Risk Level andOverall Risk

Assessment for a particular privacy campaign performed by RiskAssessment Module 430.

I. Determining Risk Level

In exemplary embodiments, the Risk Assessment Module 430 may be operableto calculate a Risk Level for a campaign based on the campaign datarelated to the personal data associated with the campaign. The RiskAssessment Module may associate the Risk Level with the record for thecampaign and digitally store the Risk Level with the record for thecampaign.

The Risk Assessment Module 430 may calculate this Risk Level based onany of various factors associated with the campaign. The Risk AssessmentModule 430 may determine a plurality of weighting factors based upon,for example: (1) the nature of the sensitive information collected aspart of the campaign (e.g., campaigns in which medical information,financial information or non-public personal identifying information iscollected may be indicated to be of higher risk than those in which onlypublic information is collected, and thus may be assigned a highernumerical weighting factor); (2) the location in which the informationis stored (e.g., campaigns in which data is stored in the cloud may bedeemed higher risk than campaigns in which the information is storedlocally); (3) the number of individuals who have access to theinformation (e.g., campaigns that permit relatively large numbers ofindividuals to access the personal data may be deemed more risky thanthose that allow only small numbers of individuals to access the data);(4) the length of time that the data will be stored within the system(e.g., campaigns that plan to store and use the personal data over along period of time may be deemed more risky than those that may onlyhold and use the personal data for a short period of time); (5) theindividuals whose sensitive information will be stored (e.g., campaignsthat involve storing and using information of minors may be deemed ofgreater risk than campaigns that involve storing and using theinformation of adults); (6) the country of residence of the individualswhose sensitive information will be stored (e.g., campaigns that involvecollecting data from individuals that live in countries that haverelatively strict privacy laws may be deemed more risky than those thatinvolve collecting data from individuals that live in countries thathave relative lax privacy laws). It should be understood that any othersuitable factors may be used to assess the Risk Level of a particularcampaign, including any new inputs that may need to be added to the riskcalculation.

In particular embodiments, one or more of the individual factors may beweighted (e.g., numerically weighted) according to the deemed relativeimportance of the factor relative to other factors (i.e., Relative RiskRating).

These weightings may be customized from organization to organization,and/or according to different applicable laws. In particularembodiments, the nature of the sensitive information will be weightedhigher than the storage location of the data, or the length of time thatthe data will be stored.

In various embodiments, the system uses a numerical formula to calculatethe Risk Level of a particular campaign. This formula may be, forexample: Risk Level for campaign=(Weighting Factor of Factor1)*(Relative Risk Rating of Factor 1)+(Weighting Factor of Factor2)*(Relative Risk Rating of Factor 2)+(Weighting Factor of FactorN)*(Relative Risk Rating of Factor N). As a simple example, the RiskLevel for a campaign that only collects publicly available informationfor adults and that stores the information locally for a short period ofseveral weeks might be determined as Risk Level=(Weighting Factor ofNature of Sensitive Information)*(Relative Risk Rating of ParticularSensitive Information to be Collected)+(Weighting Factor of Individualsfrom which Information is to be Collected)*(Relative Risk Rating ofIndividuals from which Information is to be Collected)+(Weighting Factorof Duration of Data Retention)*(Relative Risk Rating of Duration of DataRetention)+(Weighting Factor of Individuals from which Data is to beCollected)*(Relative Risk Rating of Individuals from which Data is to beCollected). In this example, the Weighting Factors may range, forexample from 1-5, and the various Relative Risk Ratings of a factor mayrange from 1-10. However, the system may use any other suitable ranges.

In particular embodiments, the Risk Assessment Module 430 may havedefault settings for assigning Overall Risk Assessments to respectivecampaigns based on the numerical Risk Level value determined for thecampaign, for example, as described above. The organization may alsomodify these settings in the Risk Assessment Module 430 by assigning itsown Overall Risk Assessments based on the numerical Risk Level. Forexample, the Risk Assessment Module 430 may, based on default or userassigned settings, designate: (1) campaigns with a Risk Level of 1-7 as“low risk” campaigns, (2) campaigns with a Risk Level of 8-15 as “mediumrisk” campaigns; (3) campaigns with a Risk Level of over 16 as “highrisk” campaigns. As show below, in an example inventory page 1500, theOverall Risk Assessment for each campaign can be indicated by up/downarrow indicators, and further, the arrows may have different shading (orcolor, or portions shaded) based upon this Overall Risk Assessment. Theselected colors may be conducive for viewing by those who suffer fromcolor blindness.

Thus, the Risk Assessment Module 430 may be configured to automaticallycalculate the numerical Risk Level for each campaign within the system,and then use the numerical Risk Level to assign an appropriate OverallRisk Assessment to the respective campaign. For example, a campaign witha Risk Level of 5 may be labeled with an Overall Risk Assessment as “LowRisk”. The system may associate both the Risk Level and the Overall RiskAssessment with the campaign and digitally store them as part of thecampaign record.

II. Exemplary Process For Assessing Risk

Accordingly, as shown in FIG. 5, in exemplary embodiments, the RiskAssessment Module 430 electronically retrieves from a database (e.g.,storage device 130) the campaign data associated with the record for theprivacy campaign. It may retrieve this information serially, or inparallel. At step 505, the Risk Assessment Module 430 retrievesinformation regarding (1) the nature of the sensitive informationcollected as part of the campaign. At step 510, the Risk AssessmentModule 430 retrieves information regarding the (2) the location in whichthe information related to the privacy campaign is stored. At step 515,the Risk Assessment Module 430 retrieves information regarding (3) thenumber of individuals who have access to the information. At step 520,the Risk Assessment Module retrieves information regarding (4) thelength of time that the data associated with a campaign will be storedwithin the System 100. At step 525, the Risk Assessment Module retrievesinformation regarding (5) the individuals whose sensitive informationwill be stored. At step 530, the Risk Assessment Module retrievesinformation regarding (6) the country of residence of the individualswhose sensitive information will be stored.

At step 535, the Risk Assessment Module takes into account any usercustomizations to the weighting factors related to each of the retrievedfactors from steps 505, 510, 515, 520, 525, and 530. At steps 540 and545, the Risk Assessment Module applies either default settings to theweighting factors (which may be based on privacy laws), orcustomizations to the weighting factors. At step 550, the RiskAssessment Module determines a plurality of weighting factors for thecampaign. For example, for the factor related to the nature of thesensitive information collected as part of the campaign, a weightingfactor of 1-5 may be assigned based on whether non-public personalidentifying information is collected.

At step 555, the Risk Assessment Module takes into account any usercustomizations to the Relative Risk assigned to each factor, and at step560 and 565, will either apply default values (which can be based onprivacy laws) or the customized values for the Relative Risk. At step570, the Risk Assessment Module assigns a relative risk rating for eachof the plurality of weighting factors. For example, the relative riskrating for the location of the information of the campaign may beassigned a numerical number (e.g., from 1-10) that is lower than thenumerical number assigned to the Relative Risk Rating for the length oftime that the sensitive information for that campaign is retained.

At step 575, the Risk Assessment Module 430 calculates the relative riskassigned to the campaign based upon the plurality of Weighting Factorsand the Relative Risk Rating for each of the plurality of factors. As anexample, the Risk Assessment Module 430 may make this calculation usingthe formula of Risk Level=(Weighting Factor of Factor 1)*(Relative RiskRating of Factor 1)+(Weighting Factor of Factor 2)*(Relative Risk Ratingof Factor 2)+ . . . (Weighting Factor of Factor N)*(Relative Risk Ratingof Factor N).

At step 580, based upon the numerical value derived from step 575, theRisk Assessment Module 430 may determine an Overall Risk Assessment forthe campaign. The Overall Risk Assessment determination may be made forthe privacy campaign may be assigned based on the following criteria,which may be either a default or customized setting: (1) campaigns witha Risk Level of 1-7 as “low risk” campaigns, (2) campaigns with a RiskLevel of 8-15 as “medium risk” campaigns; (3) campaigns with a RiskLevel of over 16 as “high risk” campaigns. The Overall Risk Assessmentis then associated and stored with the campaign record.

D. Privacy Audit Module

The System 100 may determine an audit schedule for each campaign, andindicate, in a particular graphical user interface (e.g., inventory page1500), whether a privacy audit is coming due (or is past due) for eachparticular campaign and, if so, when the audit is/was due. The System100 may also be operable to provide an audit status for each campaign,and alert personnel of upcoming or past due privacy audits. To furtherthe retention of evidence of compliance, the System 100 may also receiveand store evidence of compliance. A Privacy Audit Module 432, mayfacilitate these functions.

I. Determining a Privacy Audit Schedule and Monitoring Compliance

In exemplary embodiments, the Privacy Audit Module 432 is adapted toautomatically schedule audits and manage compliance with the auditschedule. In particular embodiments, the system may allow a user tomanually specify an audit schedule for each respective campaign. ThePrivacy Audit Module 432 may also automatically determine, and save tomemory, an appropriate audit schedule for each respective campaign,which in some circumstances, may be editable by the user.

The Privacy Audit Module 432 may automatically determine the auditschedule based on the determined Risk Level of the campaign. Forexample, all campaigns with a Risk Level less than 10 may have a firstaudit schedule and all campaigns with a Risk Level of 10 or more mayhave a second audit schedule. The Privacy Audit Module may also beoperable determine the audit schedule based on the Overall RiskAssessment for the campaign (e.g., “low risk” campaigns may have a firstpredetermined audit schedule, “medium risk” campaigns may have a secondpredetermined audit schedule, “high risk” campaigns may have a thirdpredetermined audit schedule, etc.).

In particular embodiments, the Privacy Audit Module 432 mayautomatically facilitate and monitor compliance with the determinedaudit schedules for each respective campaign. For example, the systemmay automatically generate one or more reminder emails to the respectiveowners of campaigns as the due date approaches. The system may also beadapted to allow owners of campaigns, or other users, to submit evidenceof completion of an audit (e.g., by for example, submitting screen shotsthat demonstrate that the specified parameters of each campaign arebeing followed). In particular embodiments, the system is configuredfor, in response to receiving sufficient electronic informationdocumenting completion of an audit, resetting the audit schedule (e.g.,scheduling the next audit for the campaign according to a determinedaudit schedule, as determined above).

II. Exemplary Privacy Audit Process

FIG. 6 illustrates an exemplary process performed by a Privacy AuditModule 432 for assigning a privacy audit schedule and facilitating andmanaging compliance for a particular privacy campaign. At step 605, thePrivacy Audit Module 432 retrieves the Risk Level associated with theprivacy campaign. In exemplary embodiments, the Risk Level may be anumerical number, as determined above by the Risk Assessment Module 430.If the organization chooses, the Privacy Audit Module 432 may use theOverall Risk Assessment to determine which audit schedule for thecampaign to assign.

At step 610, based on the Risk Level of the campaign (or the OverallRisk Assessment), or based on any other suitable factor, the PrivacyAudit Module 432 can assign an audit schedule for the campaign. Theaudit schedule may be, for example, a timeframe (i.e., a certain amountof time, such as number of days) until the next privacy audit on thecampaign to be performed by the one or more owners of the campaign. Theaudit schedule may be a default schedule. For example, the Privacy AuditModule can automatically apply an audit schedule of 120 days for anycampaign having Risk Level of 10 and above. These default schedules maybe modifiable. For example, the default audit schedule for campaignshaving a Risk Level of 10 and above can be changed from 120 days to 150days, such that any campaign having a Risk Level of 10 and above isassigned the customized default audit schedule (i.e., 150 days).Depending on privacy laws, default policies, authority overrides, or thepermission level of the user attempting to modify this default, thedefault might not be modifiable.

At step 615, after the audit schedule for a particular campaign hasalready been assigned, the Privacy Audit Module 432 determines if a userinput to modify the audit schedule has been received. If a user input tomodify the audit schedule has been received, then at step 620, thePrivacy Audit Module 432 determines whether the audit schedule for thecampaign is editable (i.e., can be modified). Depending on privacy laws,default policies, authority overrides, or the permission level of theuser attempting to modify the audit schedule, the campaign's auditschedule might not be modifiable.

At step 625, if the audit schedule is modifiable, then the Privacy AuditModule will allow the edit and modify the audit schedule for thecampaign. If at step 620 the Privacy Audit Module determines that theaudit schedule is not modifiable, in some exemplary embodiments, theuser may still request permission to modify the audit schedule. Forexample, the Privacy Audit Module 432 can at step 630 provide anindication that the audit schedule is not editable, but also provide anindication to the user that the user may contact through the system oneor more persons having the authority to grant or deny permission tomodify the audit schedule for the campaign (i.e., administrators) togain permission to edit the field. The Privacy Audit Module 432 maydisplay an on-screen button that, when selected by the user, sends anotification (e.g., an email) to an administrator. The user can thusmake a request to modify the audit schedule for the campaign in thismanner.

At step 635, the Privacy Audit Module may determine whether permissionhas been granted by an administrator to allow a modification to theaudit schedule. It may make this determination based on whether it hasreceived input from an administrator to allow modification of the auditschedule for the campaign. If the administrator has granted permission,the Privacy Audit Module 432 at step 635 may allow the edit of the auditschedule. If at step 640, a denial of permission is received from theadministrator, or if a certain amount of time has passed (which may becustomized or based on a default setting), the Privacy Audit Module 432retains the audit schedule for the campaign by not allowing anymodifications to the schedule, and the process may proceed to step 645.The Privacy Audit Module may also send a reminder to the administratorthat a request to modify the audit schedule for a campaign is pending.

At step 645, the Privacy Audit Module 432 determines whether a thresholdamount of time (e.g., number of days) until the audit has been reached.This threshold may be a default value, or a customized value. If thethreshold amount of time until an audit has been reached, the PrivacyAudit Module 432 may at step 650 generate an electronic alert. The alertcan be a message displayed to the collaborator the next time thecollaborator logs into the system, or the alert can be an electronicmessage sent to one or more collaborators, including the campaignowners. The alert can be, for example, an email, an instant message, atext message, or one or more of these communication modalities. Forexample, the message may state, “This is a notification that a privacyaudit for Campaign Internet Browsing History is scheduled to occur in 90days.” More than one threshold may be assigned, so that the owner of thecampaign receives more than one alert as the scheduled privacy auditdeadline approaches. If the threshold number of days has not beenreached, the Privacy Audit Module 432 will continue to evaluate whetherthe threshold has been reached (i.e., back to step 645).

In exemplary embodiments, after notifying the owner of the campaign ofan impending privacy audit, the Privacy Audit Module may determine atstep 655 whether it has received any indication or confirmation that theprivacy audit has been completed. In example embodiments, the PrivacyAudit Module allows for evidence of completion to be submitted, and ifsufficient, the Privacy Audit Module 432 at step 660 resets the counterfor the audit schedule for the campaign. For example, a privacy auditmay be confirmed upon completion of required electronic forms in whichone or more collaborators verify that their respective portions of theaudit process have been completed. Additionally, users can submitphotos, screen shots, or other documentation that show that theorganization is complying with that user's assigned portion of theprivacy campaign. For example, a database administrator may take ascreen shot showing that all personal data from the privacy campaign isbeing stored in the proper database and submit that to the system todocument compliance with the terms of the campaign.

If at step 655, no indication of completion of the audit has beenreceived, the Privacy Audit Module 432 can determine at step 665 whetheran audit for a campaign is overdue (i.e., expired). If it is notoverdue, the Privacy Audit Module 432 will continue to wait for evidenceof completion (e.g., step 655). If the audit is overdue, the PrivacyAudit Module 432 at step 670 generates an electronic alert (e.g., anemail, instant message, or text message) to the campaign owner(s) orother administrators indicating that the privacy audit is overdue, sothat the organization can take responsive or remedial measures.

In exemplary embodiments, the Privacy Audit Module 432 may also receivean indication that a privacy audit has begun (not shown), so that thestatus of the audit when displayed on inventory page 1500 shows thestatus of the audit as pending. While the audit process is pending, thePrivacy Audit Module 432 may be operable to generate reminders to besent to the campaign owner(s), for example, to remind the owner of thedeadline for completing the audit.

E. Data Flow Diagram Module

The system 110 may be operable to generate a data flow diagram based onthe campaign data entered and stored, for example in the mannerdescribed above.

I. Display of Security Indicators and Other Information

In various embodiments, a Data Flow Diagram Module is operable togenerate a flow diagram for display containing visual representations(e.g., shapes) representative of one or more parts of campaign dataassociated with a privacy campaign, and the flow of that informationfrom a source (e.g., customer), to a destination (e.g., an interne usagedatabase), to which entities and computer systems have access (e.g.,customer support, billing systems). Data Flow Diagram Module may alsogenerate one or more security indicators for display. The indicators mayinclude, for example, an “eye” icon to indicate that the data isconfidential, a “lock” icon to indicate that the data, and/or aparticular flow of data, is encrypted, or an “unlocked lock” icon toindicate that the data, and/or a particular flow of data, is notencrypted. In the example shown in FIG. 16, the dotted arrow linesgenerally depict respective flows of data and the locked or unlockedlock symbols indicate whether those data flows are encrypted orunencrypted. The color of dotted lines representing data flows may alsobe colored differently based on whether the data flow is encrypted ornon-encrypted, with colors conducive for viewing by those who sufferfrom color blindness.

II. Exemplary Process Performed by Data Flow Diagram Module

FIG. 7 shows an example process performed by the Data Flow DiagramModule 700. At step 705, the Data Flow Diagram retrieves campaign datarelated to a privacy campaign record. The campaign data may indicate,for example, that the sensitive information related to the privacycampaign contains confidential information, such as the social securitynumbers of a customer.

At step 710, the Data Flow Diagram Module 700 is operable to displayon-screen objects (e.g., shapes) representative of the Source,Destination, and Access, which indicate that information below theheading relates to the source of the personal data, the storagedestination of the personal data, and access related to the personaldata. In addition to campaign data regarding Source, Destination, andAccess, the Data Flow Diagram Module 700 may also account for userdefined attributes related to personal data, which may also be displayedas on-screen objects. The shape may be, for example, a rectangular box(see, e.g., FIG. 16). At step 715, the Data Flow Diagram Module 700 maydisplay a hyperlink label within the on-screen object (e.g., as shown inFIG. 16, the word “Customer” may be a hyperlink displayed within therectangular box) indicative of the source of the personal data, thestorage destination of the personal data, and access related to thepersonal data, under each of the respective headings. When a user hoversover the hyperlinked word, the Data Flow Diagram is operable to displayadditional campaign data relating to the campaign data associated withthe hyperlinked word. The additional information may also be displayedin a pop up, or a new page. For example, FIG. 16 shows that if a userhovers over the words “Customer,” the Data Flow Diagram Module 700displays what customer information is associated with the campaign(e.g., the Subscriber ID, the IP and Mac Addresses associated with theCustomer, and the customer's browsing and usage history). The Data FlowDiagram Module 700 may also generate for display information relating towhether the source of the data includes minors, and whether consent wasgiven by the source to use the sensitive information, as well as themanner of the consent (for example, through an End User LicenseAgreement (EULA)).

At step 720, the Data Flow Diagram Module 700 may display one or moreparameters related to backup and retention of personal data related tothe campaign, including in association with the storage destination ofthe personal data. As an example, Data Flow Diagram 1615 of FIG. 16displays that the information in the Internet Usage database is backedup, and the retention related to that data is Unknown.

At 725, the Data Flow Diagram Module 700 determines, based on thecampaign data associated with the campaign, whether the personal datarelated to each of the hyperlink labels is confidential. At Step 730, ifthe personal data related to each hyperlink label is confidential, theData Flow Diagram Module 700 generates visual indicator indicatingconfidentiality of that data (e.g., an “eye” icon, as show in Data FlowDiagram 1615). If there is no confidential information for that box,then at step 735, no indicators are displayed. While this is an exampleof the generation of indicators for this particular hyperlink, inexemplary embodiments, any user defined campaign data may visualindicators that may be generated for it.

At step 740, the Data Flow Diagram Module 700 determined whether any ofthe data associated with the source, stored in a storage destination,being used by an entity or application, or flowing to one or moreentities or systems (i.e., data flow) associated with the campaign isdesignated as encrypted. If the data is encrypted, then at step 745 theData Flow Diagram Module 700 may generate an indicator that the personaldata is encrypted (e.g., a “lock” icon). If the data is non-encrypted,then at step 750, the Data Flow Diagram Module 700 displays an indicatorto indicate that the data or particular flow of data is not encrypted.(e.g., an “unlocked lock” icon). An example of a data flow diagram isdepicted in FIG. 9. Additionally, the data flow diagram lines may becolored differently to indicate whether the data flow is encrypted orunencrypted, wherein the colors can still be distinguished by acolor-blind person.

F. Communications Module

In exemplary embodiments, a Communications Module of the System 100 mayfacilitate the communications between various owners and personnelrelated to a privacy campaign. The Communications Module may retaincontact information (e.g., emails or instant messaging contactinformation) input by campaign owners and other collaborators. TheCommunications Module can be operable to take a generated notificationor alert (e.g., alert in step 670 generated by Privacy Audit Module 432)and instantiate an email containing the relevant information. Asmentioned above, the Main Privacy Compliance Module 400 may, for examplethrough a communications module, be operable to send collaboratorsemails regarding their assignment of one or more portions of inputs tocampaign data. Or through the communications module, selecting thecommentators button brings up one or more collaborators that are on-line

In exemplary embodiments, the Communications Module can also, inresponse to a user request (e.g., depressing the “comment” button showin FIG. 9, FIG. 10, FIG. 11, FIG. 12, FIG. 13, FIG. 16), instantiate aninstant messaging session and overlay the instant messaging session overone or more portions of a GUI, including a GUI in which a user ispresented with prompts to enter or select information. An example ofthis instant messaging overlay feature orchestrated by theCommunications Module is shown in FIG. 14. While a real-time messagesession may be generated, off-line users may still able to see themessages when they are back on-line.

The Communications Module may facilitate the generation of alerts thatindicate that one or more emails or instant messages await acollaborator.

If campaign data inputs have been assigned to one or more collaborators,but those collaborators have not input the data yet, the CommunicationsModule, may facilitate the sending of an electronic message (such as anemail) alerting the collaborators and owners that they have not yetsupplied their designated portion of campaign data.

Exemplary User Experience

In the exemplary embodiments of the system for operationalizing privacycompliance, adding a campaign (i.e., data flow) comprises gatheringinformation that includes several phases: (1) a description of thecampaign; (2) the personal data to be collected as part of the campaign;(3) who the personal data relates to; (4) where the personal data bestored; and (5) who will have access to the indicated personal data.

A. FIG. 8: Campaign Record Creation and Collaborator Assignment

FIG. 8 illustrates an example of the first phase of informationgathering to add a campaign. In FIG. 8, a description entry dialog 800may have several fillable/editable fields and drop-down selectors. Inthis example, the user may fill out the name of the campaign in theShort Summary (name) field 805, and a description of the campaign in theDescription field 810. The user may enter or select the name of thebusiness group (or groups) that will be accessing personal data for thecampaign in the Business Group field 815. The user may select theprimary business representative responsible for the campaign (i.e., thecampaign's owner), and designate him/herself, or designate someone elseto be that owner by entering that selection through the Someone Elsefield 820. Similarly, the user may designate him/herself as the privacyoffice representative owner for the campaign, or select someone elsefrom the second Someone Else field 825. At any point, a user assigned asthe owner may also assign others the task of selecting or answering anyquestion related to the campaign. The user may also enter one or moretag words associated with the campaign in the Tags field 830. Afterentry, the tag words may be used to search for campaigns, or used tofilter for campaigns (for example, under Filters 845). The user mayassign a due date for completing the campaign entry, and turn remindersfor the campaign on or off. The user may save and continue, or assignand close.

In example embodiments, some of the fields may be filled in by a user,with suggest-as-you-type display of possible field entries (e.g.,Business Group field 815), and/or may include the ability for the userto select items from a drop-down selector (e.g., drop-down selectors 840a, 840 b, 840 c). The system may also allow some fields to stay hiddenor unmodifiable to certain designated viewers or categories of users.For example, the purpose behind a campaign may be hidden from anyone whois not the chief privacy officer of the company, or the retentionschedule may be configured so that it cannot be modified by anyoneoutside of the organization's' legal department.

B. FIG. 9: Collaborator Assignment Notification and Description Entry

Moving to FIG. 9, in example embodiments, if another businessrepresentative (owner), or another privacy office representative hasbeen assigned to the campaign (e.g., John Doe in FIG. 8), the system maysend a notification (e.g., an electronic notification) to the assignedindividual, letting them know that the campaign has been assigned tohim/her. FIG. 9 shows an example notification 900 sent to John Doe thatis in the form of an email message. The email informs him that thecampaign “Internet Usage Tracking” has been assigned to him, andprovides other relevant information, including the deadline forcompleting the campaign entry and instructions to log in to the systemto complete the campaign (data flow) entry (which may be done, forexample, using a suitable “wizard” program). The user that assigned Johnownership of the campaign may also include additional comments 905 to beincluded with the notification 900. Also included may be an option toreply to the email if an assigned owner has any questions.

In this example, if John selects the hyperlink Privacy Portal 910, he isable to access the system, which displays a landing page 915. Thelanding page 915 displays a Getting Started section 920 to familiarizenew owners with the system, and also display an “About This Data Flow”section 930 showing overview information for the campaign.

C. FIG. 10: What Personal Data is Collected

Moving to FIG. 10, after the first phase of campaign addition (i.e.,description entry phase), the system may present the user (who may be asubsequently assigned business representative or privacy officer) with adialog 1000 from which the user may enter in the type of personal databeing collected.

In addition, questions are described generally as transitionalquestions, but the questions may also include one or more smartquestions in which the system is configured to: (1) pose an initialquestion to a user and, (2) in response to the user's answer satisfyingcertain criteria, presenting the user with one or more follow-upquestions. For example, in FIG. 10, if the user responds with a choiceto add personal data, the user may be additionally presented follow-upprompts, for example, the select personal data window overlaying screen800 that includes commonly used selections may include, for example,particular elements of an individual's contact information (e.g., name,address, email address), Financial/Billing Information (e.g., creditcard number, billing address, bank account number), Online Identifiers(e.g., IP Address, device type, MAC Address), Personal Details(Birthdate, Credit Score, Location), or Telecommunication Data (e.g.,Call History, SMS History, Roaming Status). The System 100 is alsooperable to pre-select or automatically populate choices—for example,with commonly-used selections 1005, some of the boxes may already bechecked. The user may also use a search/add tool 1010 to search forother selections that are not commonly used and add another selection.Based on the selections made, the user may be presented with moreoptions and fields. For example, if the user selected “Subscriber ID” aspersonal data associated with the campaign, the user may be prompted toadd a collection purpose under the heading Collection Purpose 1015, andthe user may be prompted to provide the business reason why a SubscriberID is being collected under the “Describe Business Need” heading 1020.

D. FIG. 11: Who Personal Data is Collected From

As displayed in the example of FIG. 11, the third phase of adding acampaign may relate to entering and selecting information regarding whothe personal data is gathered from. As noted above, the personal datamay be gathered from, for example, one or more Subjects 100. In theexemplary “Collected From” dialog 1100, a user may be presented withseveral selections in the “Who Is It Collected From” section 1105. Theseselections may include whether the personal data was to be collectedfrom an employee, customer, or other entity. Any entities that are notstored in the system may be added. The selections may also include, forexample, whether the data was collected from a current or prospectivesubject (e.g., a prospective employee may have filled out an employmentapplication with his/her social security number on it). Additionally,the selections may include how consent was given, for example through anend user license agreement (EULA), on-line Opt-in prompt, Impliedconsent, or an indication that the user is not sure. Additionalselections may include whether the personal data was collected from aminor, and where the subject is located.

E. FIG. 12: Where is the Personal Data Stored

FIG. 12 shows an example “Storage Entry” dialog screen 1200, which is agraphical user interface that a user may use to indicate whereparticular sensitive information is to be stored within the system. Fromthis section, a user may specify, in this case for the Internet UsageHistory campaign, the primary destination of the personal data 1220 andhow long the personal data is to be kept 1230. The personal data may behoused by the organization (in this example, an entity called “Acme”) ora third party. The user may specify an application associated with thepersonal data's storage (in this example, ISP Analytics), and may alsospecify the location of computing systems (e.g., servers) that will bestoring the personal data (e.g., a Toronto data center). Otherselections indicate whether the data will be encrypted and/or backed up.

The system also allows the user to select whether the destinationsettings are applicable to all the personal data of the campaign, orjust select data (and if so, which data). In FIG. 12, the user may alsoselect and input options related to the retention of the personal datacollected for the campaign (e.g., How Long Is It Kept 1230). Theretention options may indicate, for example, that the campaign'spersonal data should be deleted after a per-determined period of timehas passed (e.g., on a particular date), or that the campaign's personaldata should be deleted in accordance with the occurrence of one or morespecified events (e.g., in response to the occurrence of a particularevent, or after a specified period of time passes after the occurrenceof a particular event), and the user may also select whether backupsshould be accounted for in any retention schedule. For example, the usermay specify that any backups of the personal data should be deleted (or,alternatively, retained) when the primary copy of the personal data isdeleted.

F. FIG. 13: Who and What Systems Have Access to Personal Data

FIG. 13 describes an example Access entry dialog screen 1300. As part ofthe process of adding a campaign or data flow, the user may specify inthe “Who Has Access” section 1305 of the dialog screen 1300. In theexample shown, the Customer Support, Billing, and Government groupswithin the organization are able to access the Internet Usage Historypersonal data collected by the organization. Within each of these accessgroups, the user may select the type of each group, the format in whichthe personal data was provided, and whether the personal data isencrypted. The access level of each group may also be entered. The usermay add additional access groups via the Add Group button 1310.

G. Facilitating Entry of Campaign Data, Including Chat Shown in FIG. 14

As mentioned above, to facilitate the entry of data collected throughthe example GUIs shown in FIGS. 8 through 12, in exemplary embodiments,the system is adapted to allow the owner of a particular campaign (orother user) to assign certain sections of questions, or individualquestions, related to the campaign to contributors other than the owner.This may eliminate the need for the owner to contact other users todetermine information that they don't know and then enter theinformation into the system themselves. Rather, in various embodiments,the system facilitates the entry of the requested information directlyinto the system by the assigned users.

In exemplary embodiments, after the owner assigns a respectiveresponsible party to each question or section of questions that need tobe answered in order to fully populate the data flow, the system mayautomatically contact each user (e.g., via an appropriate electronicmessage) to inform the user that they have been assigned to complete thespecified questions and/or sections of questions, and provide thoseusers with instructions as to how to log into the system to enter thedata. The system may also be adapted to periodically follow up with eachuser with reminders until the user completes the designated tasks. Asdiscussed elsewhere herein, the system may also be adapted to facilitatereal-time text or voice communications between multiple collaborators asthey work together to complete the questions necessary to define thedata flow. Together, these features may reduce the amount of time andeffort needed to complete each data flow.

To further facilitate collaboration, as shown FIG. 14, in exemplaryembodiments, the System 100 is operable to overlay an instant messagingsession over a GUI in which a user is presented with prompts to enter orselect information. In FIG. 14, a communications module is operable tocreate an instant messaging session window 1405 that overlays the Accessentry dialog screen 1400. In exemplary embodiments, the CommunicationsModule, in response to a user request (e.g., depressing the “comment”button show in FIG. 9, FIG. 10, FIG. 11, FIG. 12, FIG. 13, FIG. 16),instantiates an instant messaging session and overlays the instantmessaging session over one or more portions of the GUI.

H: FIG. 15: Campaign Inventory Page

After new campaigns have been added, for example using the exemplaryprocesses explained in regard to FIGS. 8-13, the users of the system mayview their respective campaign or campaigns, depending on whether theyhave access to the campaign. The chief privacy officer, or anotherprivacy office representative, for example, may be the only user thatmay view all campaigns. A listing of all of the campaigns within thesystem may be viewed on, for example, inventory page 1500 (see below).Further details regarding each campaign may be viewed via, for example,campaign information page 1600, which may be accessed by selecting aparticular campaign on the inventory page 1500. And any informationrelated to the campaign may be edited or added through, for example, theedit campaign dialog 1700 screen (see FIG. 17). Certain fields orinformation may not be editable, depending on the particular user'slevel of access. A user may also add a new campaign using a suitableuser interface, such as the graphical user interface shown in FIG. 15 orFIG. 16.

In example embodiments, the System 100 (and more particularly, the MainPrivacy Compliance Module 400) may use the history of past entries tosuggest selections for users during campaign creation and entry ofassociated data. As an example, in FIG. 10, if most entries that containthe term “Internet” and have John Doe as the business rep assigned tothe campaign have the items Subscriber ID, IP Address, and MAC Addressselected, then the items that are commonly used may display aspre-selected items the Subscriber ID, IP address, and MAC Address eachtime a campaign is created having Internet in its description and JohnDoe as its business rep.

FIG. 15 describes an example embodiment of an inventory page 1500 thatmay be generated by the Main Privacy Compliance Module 400. Theinventory page 1500 may be represented in a graphical user interface.Each of the graphical user interfaces (e.g., webpages, dialog boxes,etc.) presented in this application may be, in various embodiments, anHTML-based page capable of being displayed on a web browser (e.g.,Firefox, Internet Explorer, Google Chrome, Opera, etc.), or any othercomputer-generated graphical user interface operable to displayinformation, including information having interactive elements (e.g., aniOS, Mac OS, Android, Linux, or Microsoft Windows application). Thewebpage displaying the inventory page 1500 may include typical featuressuch as a scroll-bar, menu items, as well as buttons for minimizing,maximizing, and closing the webpage. The inventory page 1500 may beaccessible to the organization's chief privacy officer, or any other ofthe organization's personnel having the need, and/or permission, to viewpersonal data.

Still referring to FIG. 15, inventory page 1500 may display one or morecampaigns listed in the column heading Data Flow Summary 1505, as wellas other information associated with each campaign, as described herein.Some of the exemplary listed campaigns include Internet Usage History1510, Customer Payment Information, Call History Log, Cellular RoamingRecords, etc. A campaign may represent, for example, a businessoperation that the organization is engaged in may require the use ofpersonal data, which may include the personal data of a customer. In thecampaign Internet Usage History 1510, for example, a marketingdepartment may need customers' on-line browsing patterns to runanalytics. Examples of more information that may be associated with theInternet Usage History 1510 campaign will be presented in FIG. 4 andFIG. 5. In example embodiments, clicking on (i.e., selecting) the columnheading Data Flow Summary 1505 may result in the campaigns being sortedeither alphabetically, or reverse alphabetically.

The inventory page 1500 may also display the status of each campaign, asindicated in column heading Status 1515. Exemplary statuses may include“Pending Review”, which means the campaign has not been approved yet,“Approved,” meaning the data flow associated with that campaign has beenapproved, “Audit Needed,” which may indicate that a privacy audit of thepersonal data associated with the campaign is needed, and “ActionRequired,” meaning that one or more individuals associated with thecampaign must take some kind of action related to the campaign (e.g.,completing missing information, responding to an outstanding message,etc.). In certain embodiments, clicking on (i.e., selecting) the columnheading Status 1515 may result in the campaigns being sorted by status.

The inventory page 1500 of FIG. 15 may list the “source” from which thepersonal data associated with a campaign originated, under the columnheading “Source” 1520. The sources may include one or more of thesubjects 100 in example FIG. 1. As an example, the campaign “InternetUsage History” 1510 may include a customer's IP address or MAC address.For the example campaign “Employee Reference Checks”, the source may bea particular employee. In example embodiments, clicking on (i.e.,selecting) the column heading Source 1520 may result in the campaignsbeing sorted by source.

The inventory page 1500 of FIG. 15 may also list the “destination” ofthe personal data associated with a particular campaign under the columnheading Destination 1525. Personal data may be stored in any of avariety of places, for example on one or more storage devices 280 thatare maintained by a particular entity at a particular location.Different custodians may maintain one or more of the different storagedevices. By way of example, referring to FIG. 15, the personal dataassociated with the Internet Usage History campaign 1510 may be storedin a repository located at the Toronto data center, and the repositorymay be controlled by the organization (e.g., Acme corporation) oranother entity, such as a vendor of the organization that has been hiredby the organization to analyze the customer's internet usage history.Alternatively, storage may be with a department within the organization(e.g., its marketing department). In example embodiments, clicking on(i.e., selecting) the column heading Destination 1525 may result in thecampaigns being sorted by destination.

On the inventory page 1500, the Access heading 1530 may show the numberof transfers that the personal data associated with a campaign hasundergone. In example embodiments, clicking on (i.e., selecting) thecolumn heading “Access” 1530 may result in the campaigns being sorted byAccess.

The column with the heading Audit 1535 shows the status of any privacyaudits associated with the campaign. Privacy audits may be pending, inwhich an audit has been initiated but yet to be completed. The auditcolumn may also show for the associated campaign how many days havepassed since a privacy audit was last conducted for that campaign.(e.g., 140 days, 360 days). If no audit for a campaign is currentlyrequired, an “OK” or some other type of indication of compliance (e.g.,a “thumbs up” indicia) may be displayed for that campaign's auditstatus. Campaigns may also be sorted based on their privacy audit statusby selecting or clicking on the Audit heading 1535.

In example inventory page 1500, an indicator under the heading Risk 1540may also display an indicator as to the Risk Level associated with thepersonal data for a particular campaign. As described earlier, a riskassessment may be made for each campaign based on one or more factorsthat may be obtained by the system. The indicator may, for example, be anumerical score (e.g., Risk Level of the campaign), or, as in theexample shown in FIG. 15, it may be arrows that indicate the OverallRisk Assessment for the campaign. The arrows may be of different shadesor different colors (e.g., red arrows indicating “high risk” campaigns,yellow arrows indicating “medium risk” campaigns, and green arrowsindicating “low risk” campaigns). The direction of the arrows—forexample, pointing upward or downward, may also provide a quickindication of Overall Risk Assessment for users viewing the inventorypage 1500. Each campaign may be sorted based on the Risk Levelassociated with the campaign.

The example inventory page 1500 may comprise a filter tool, indicated byFilters 1545, to display only the campaigns having certain informationassociated with them. For example, as shown in FIG. 15, under CollectionPurpose 1550, checking the boxes “Commercial Relations,” “ProvideProducts/Services”, “Understand Needs,” “Develop Business & Ops,” and“Legal Requirement” will result the display under the Data Flow Summary1505 of only the campaigns that meet those selected collection purposerequirements.

From example inventory page 1500, a user may also add a campaign byselecting (i.e., clicking on) Add Data Flow 1555. Once this selectionhas been made, the system initiates a routine to guide the user in aphase-by-phase manner through the process of creating a new campaign(further details herein). An example of the multi-phase GUIs in whichcampaign data associated with the added privacy campaign may be inputand associated with the privacy campaign record is described in FIG.8-13 above.

From the example inventory page 1500, a user may view the informationassociated with each campaign in more depth, or edit the informationassociated with each campaign. To do this, the user may, for example,click on or select the name of the campaign (i.e., click on InternetUsage History 1510). As another example, the user may select a buttondisplayed on screen indicating that the campaign data is editable (e.g.,edit button 1560).

I: FIG. 16: Campaign Information Page and Data Flow Diagram

FIG. 16 shows an example of information associated with each campaignbeing displayed in a campaign information page 1600. Campaigninformation page 1600 may be accessed by selecting (i.e., clicking on),for example, the edit button 1560. In this example, Personal DataCollected section 1605 displays the type of personal data collected fromthe customer for the campaign Internet Usage History. The type ofpersonal data, which may be stored as data elements associated with theInternet Usage History campaign digital record entry. The type ofinformation may include, for example, the customer's Subscriber ID,which may be assigned by the organization (e.g., a customeridentification number, customer account number). The type of informationmay also include data associated with a customer's premises equipment,such as an IP Address, MAC Address, URL History (i.e., websitesvisited), and Data Consumption (i.e., the number of megabytes orgigabytes that the user has download).

Still referring to FIG. 16, the “About this Data Flow” section 1610displays relevant information concerning the campaign, such as thepurpose of the campaign. In this example, a user may see that theInternet Usage History campaign is involved with the tracking ofinternet usage from customers in order to bill appropriately, manageagainst quotas, and run analytics. The user may also see that thebusiness group that is using the sensitive information associated withthis campaign is the Internet group. A user may further see that thenext privacy audit is scheduled for Jun. 10, 2016, and that the lastupdate of the campaign entry was Jan. 2, 2015. The user may also selectthe “view history” hyperlink to display the history of the campaign.

FIG. 16 also depicts an example of a Data Flow Diagram 1615 generated bythe system, based on information provided for the campaign. The DataFlow Diagram 1615 may provide the user with a large amount ofinformation regarding a particular campaign in a single compact visual.In this example, for the campaign Internet Usage History, the user maysee that the source of the personal data is the organization'scustomers. In example embodiments, as illustrated, hovering the cursor(e.g., using a touchpad, or a mouse) over the term “Customers” may causethe system to display the type of sensitive information obtained fromthe respective consumers, which may correspond with the informationdisplayed in the “Personal Data Collected” section 1605.

In various embodiments, the Data Flow Diagram 1615 also displays thedestination of the data collected from the User (in this example, anInternet Usage Database), along with associated parameters related tobackup and deletion. The Data Flow Diagram 1615 may also display to theuser which department(s) and what system(s) have access to the personaldata associated with the campaign. In this example, the Customer SupportDepartment has access to the data, and the Billing System may retrievedata from the Internet Usage Database to carry out that system'soperations. In the Data Flow Diagram 1615, one or more securityindicators may also be displayed. The may include, for example, an “eye”icon to indicate that the data is confidential, a “lock” icon toindicate that the data, and/or a particular flow of data, is encrypted,or an “unlocked lock” icon to indicate that the data, and/or aparticular flow of data, is not encrypted. In the example shown in FIG.16, the dotted arrow lines generally depict respective flows of data andthe locked or unlocked lock symbols indicate whether those data flowsare encrypted or unencrypted.

Campaign information page 1600 may also facilitate communications amongthe various personnel administrating the campaign and the personal dataassociated with it. Collaborators may be added through the Collaboratorsbutton 1625. The system may draw information from, for example, anactive directory system, to access the contact information ofcollaborators.

If comment 1630 is selected, a real-time communication session (e.g., aninstant messaging session) among all (or some) of the collaborators maybe instantiated and overlaid on top of the page 1600. This may behelpful, for example, in facilitating population of a particular page ofdata by multiple users. In example embodiments, the Collaborators 1625and Comments 1630 button may be included on any graphical user interfacedescribed herein, including dialog boxes in which information is enteredor selected. Likewise, any instant messaging session may be overlaid ontop of a webpage or dialog box. The system may also use the contactinformation to send one or more users associated with the campaignperiodic updates, or reminders. For example, if the deadline to finishentering the campaign data associated with a campaign is upcoming inthree days, the business representative of that assigned campaign may besent a message reminding him or her that the deadline is in three days.

Like inventory page 1500, campaign information page 1600 also allows forcampaigns to be sorted based on risk (e.g., Sort by Risk 1635). Thus,for example, a user is able to look at the information for campaignswith the highest risk assessment.

J: FIG. 17: Edit Campaign Dialog

FIG. 17 depicts an example of a dialog box—the edit campaign dialog1700. The edit campaign dialog 1700 may have editable fields associatedwith a campaign. In this example, the information associated with theInternet Usage History campaign may be edited via this dialog. Thisincludes the ability for the user to change the name of the campaign,the campaign's description, the business group, the current owner of thecampaign, and the particular personal data that is associated with thecampaign (e.g., IP address, billing address, credit score, etc.). Inexample embodiments, the edit campaign dialog 1700 may also allow forthe addition of more factors, checkboxes, users, etc.

The system 100 also includes a Historical Record Keeping Module, whereinevery answer, change to answer, as well as assignment/re-assignment ofowners and collaborators is logged for historical record keeping.

Automated Approach to Demonstrating Privacy By Design, and IntegrationWith Software Development and Agile Tools For Privacy Design

In particular embodiments, privacy by design can be used in the designphase of a product (e.g., hardware or software), which is a documentedapproach to managing privacy risks. One of the primary concepts isevaluating privacy impacts, and making appropriate privacy-protectingchanges during the design of a project, before the project go-live.

In various embodiments, the system is adapted to automate this processwith the following capabilities: (1) initial assessment; (2) gapanalysis/recommended steps; and/or (3) final/updated assessment. Thesecapabilities are discussed in greater detail below.

Initial Assessment

In various embodiments, when a business team within a particularorganization is planning to begin a privacy campaign, the systempresents the business team with a set of assessment questions that aredesigned to help one or more members of the organization's privacy teamto understand what the business team's plans are, and to understandwhether the privacy campaign may have a privacy impact on theorganization. The questions may also include a request for the businessteam to provide the “go-live” date, or implementation date, for theprivacy campaign. In response to receiving the answers to thesequestions, the system stores the answers to the system's memory andmakes the answers available to the organization's privacy team. Thesystem may also add the “go-live” date to one or more electroniccalendars (e.g., the system's electronic docket).

In some implementations, the initial assessment can include an initialprivacy impact assessment that evaluates one or more privacy impactfeatures of the proposed design of the product. The initial privacyimpact assessment incorporates the respective answers for the pluralityof question/answer pairings in the evaluation of the one or more privacyimpact features. The privacy impact features may, for example, berelated to how the proposed design of the new product will collect, use,store, and/or manage personal data. One or more of these privacy impactfeatures can be evaluated, and the initial privacy assessment can beprovided to identify results of the evaluation.

Gap Analysis/Recommended Steps

After the system receives the answers to the questions, one or moremembers of the privacy team may review the answers to the questions. Theprivacy team may then enter, into the system, guidance and/orrecommendations regarding the privacy campaign. In some implementations,the privacy team may input their recommendations into the privacycompliance software. In particular embodiments, the system automaticallycommunicates the privacy team's recommendations to the business teamand, if necessary, reminds one or more members of the business team toimplement the privacy team's recommendations before the go-live date.The system may also implement one or more audits (e.g., as describedabove) to make sure that the business team incorporates the privacyteam's recommendations before the “go-live” date.

The recommendations may include one or more recommended steps that canbe related to modifying one or more aspects of how the product willcollect, use, store, and/or manage personal data. The recommended stepsmay include, for example: (1) limiting the time period that personaldata is held by the system (e.g., seven days); (2) requiring thepersonal data to be encrypted when communicated or stored; (3)anonymizing personal data; or (4) restricting access to personal data toa particular, limited group of individuals. The one or more recommendedsteps may be provided to address a privacy concern with one or more ofthe privacy impact features that were evaluated in the initial privacyimpact assessment.

In response to a recommended one or more steps being provided (e.g., bythe privacy compliance officers), the system may generate one or moretasks in suitable project management software that is used in managingthe proposed design of the product at issue. In various embodiments, theone or more tasks may be tasks that, if recommended, would individuallyor collectively complete one or more (e.g., all of) the recommendedsteps. For example, if the one or more recommended steps includerequiring personal data collected by the product to be encrypted, thenthe one or more tasks may include revising the product so that itencrypts any personal data that it collects.

The one or more tasks may include, for example, different steps to beperformed at different points in the development of the product. Inparticular embodiments, the computer software application may alsomonitor, either automatically or through suitable data inputs, thedevelopment of the product to determine whether the one or more taskshave been completed.

Upon completion of each respective task in the one or more tasks, thesystem may provide a notification that the task has been completed. Forexample, the project management software may provide a suitablenotification to the privacy compliance software that the respective taskhas been completed.

Final/Updated Assessment

Once the mitigation steps and recommendations are complete, the systemmay (e.g., automatically) conduct an updated review to assess anyprivacy risks associated with the revised product.

In particular embodiments, the system includes unique reporting andhistorical logging capabilities to automate Privacy-by-Design reportingand/or privacy assessment reporting. In various embodiments, the systemis adapted to: (1) measure/analyze the initial assessment answers fromthe business team; (2) measure recommendations for the privacy campaign;(3) measure any changes that were implemented prior to the go-live date;(4) automatically differentiate between: (a) substantive privacyprotecting changes, such as the addition of encryption, anonymization,or minimizations; and (b) non-substantive changes, such as spellingcorrection.

The system may also be adapted to generate a privacy assessment reportshowing that, in the course of a business's normal operations: (1) thebusiness evaluates projects prior to go-live for compliance with one ormore privacy-related regulations or policies; and (2) relatedsubstantive recommendations are made and implemented prior to go-live.This may be useful in documenting that privacy-by-design is beingeffectively implemented for a particular privacy campaign.

The privacy assessment report may, in various embodiments, include anupdated privacy impact assessment that evaluates the one or more privacyimpact features after the one or more recommended steps discussed aboveare implemented. The system may generate this updated privacy impactassessment automatically by, for example, automatically modifying anyanswers from within the question/answer pairings of the initial impactprivacy assessment to reflect any modifications to the product that havebeen made in the course of completing the one or more tasks thatimplement the one or more substantive recommendations. For example, if aparticular question from the initial privacy impact assessment indicatedthat certain personal data was personally identifiable data, and arecommendation was made to anonymize the data, the question/answerpairing for the particular question could be revised so the answer tothe question indicates that the data has been anonymized. Any revisedquestion/answer pairings may then be used to complete an updated privacyassessment report.

FIGS. 18A and 18B show an example process performed by a Data PrivacyCompliance Module 1800. In executing the Data Privacy Compliance Module1800, the system begins at Step 1802, where it presents a series ofquestions to a user (e.g., via a suitable computer display screen orother user-interface, such as a voice-interface) regarding the designand/or anticipated operation of the product. This may be done, forexample, by having a first software application (e.g., a data privacysoftware application or other suitable application) present the userwith a template of questions regarding the product (e.g., for use inconducting an initial privacy impact assessment for the product). Suchquestions may include, for example, data mapping questions and otherquestions relevant to the product's design and/or anticipated operation.

Next, the at Step 1804, the system receives, via a first computersoftware application, from a first set of one or more users (e.g.,product designers, such as software designers, or other individuals whoare knowledgeable about the product), respective answers to thequestions regarding the product and associates the respective answerswith their corresponding respective questions within memory to create aplurality of question/answer pairings regarding the proposed design ofthe product (e.g., software, a computerized electro-mechanical product,or other product).

Next, at Step 1806, the system presents a question to one or more usersrequesting the scheduled implantation date for the product. At Step1808, the system receives this response and saves the scheduledimplementation date to memory.

Next, after receiving the respective answers at Step 1804, the systemdisplays, at Step 1810, the respective answers (e.g., along with theirrespective questions and/or a summary of the respective questions) to asecond set of one or more users (e.g., one or more privacy officers fromthe organization that is designing the product), for example, in theform a plurality of suitable question/answer pairings. As an aside,within the context of this specification, pairings of an answer andeither its respective question or a summary of the question may bereferred to as a “question/answer” pairing. As an example, the question“Is the data encrypted? and respective answer “Yes” may be represented,for example, in either of the following question/answer pairings: (1)“The data is encrypted”; and (2) “Data encrypted? Yes”. Alternatively,the question/answer pairing may be represented as a value in aparticular field in a data structure that would convey that the data atissue is encrypted.

The system then advances to Step 1812, where it receives, from thesecond set of users, one or more recommended steps to be implemented aspart of the proposed design of the product and before the implementationdate, the one or more recommended steps comprising one or more stepsthat facilitate the compliance of the product with the one or moreprivacy standards and/or policies. In particular embodiments in whichthe product is a software application or an electro-mechanical devicethat runs device software, the one or more recommended steps maycomprise modifying the software application or device software to complywith one or more privacy standards and/or policies.

Next, at Step 1814, in response to receiving the one or more recommendedsteps, the system automatically initiates the generation of one or moretasks in a second computer software application (e.g., projectmanagement software) that is to be used in managing the design of theproduct. In particular embodiments, the one or more tasks comprise oneor more tasks that, if completed, individually and/or collectively wouldresult in the completion of the one or more recommended steps. Thesystem may do this, for example, by facilitating communication betweenthe first and second computer software applications via a suitableapplication programming interface (API).

The system then initiates a monitoring process for determining whetherthe one or more tasks have been completed. This step may, for example,be implemented by automatically monitoring which changes (e.g., edits tosoftware code) have been made to the product, or by receiving manualinput confirming that various tasks have been completed.

Finally, at Step 1816, at least partially in response to the firstcomputer software application being provided with the notification thatthe task has been completed, the system generates an updated privacyassessment for the product that reflects the fact that the task has beencompleted. The system may generate this updated privacy impactassessment automatically by, for example, automatically modifying anyanswers from within the question/answer pairings of the initial impactprivacy assessment to reflect any modifications to the product that havebeen made in the course of completing the one or more tasks thatimplement the one or more substantive recommendations. For example, if aparticular question from the initial privacy impact assessment indicatedthat certain personal data was personally-identifiable data, and arecommendation was made to anonymize the data, the question/answerpairing for the particular question could be revised so that the answerto the question indicates that the data has been anonymized. Any revisedquestion/answer pairings may then be used to complete an updated privacyassessment report.

FIGS. 19A-19B depict the operation of a Privacy-By-Design Module 1900.In various embodiments, when the system executes the Privacy-By-DesignModule 1900, the system begins, at Step 1902, where it presents a seriesof questions to a user (e.g., via a suitable computer display screen orother user-interface, such as a voice-interface) regarding the designand/or anticipated operation of the product. This may be done, forexample, by having a first software application (e.g., a data privacysoftware application or other suitable application) present the userwith a template of questions regarding the product (e.g., for use inconducting an initial privacy impact assessment for the product). Suchquestions may include, for example, data mapping questions and otherquestions relevant to the product's design and/or anticipated operation.

Next, the at Step 1904, the system receives, e.g., via a first computersoftware application, from a first set of one or more users (e.g.,product designers, such as software designers, or other individuals whoare knowledgeable about the product), respective answers to thequestions regarding the product and associates the respective answerswith their corresponding respective questions within memory to create aplurality of question/answer pairings regarding the proposed design ofthe product (e.g., software, a computerized electro-mechanical product,or other product).

Next, at Step 1906, the system presents a question to one or more usersrequesting the scheduled implantation date for the product. At Step1908, the system receives this response and saves the scheduledimplementation date to memory.

Next, after receiving the respective answers at Step 1904, the systemdisplays, at Step 1910, the respective answers (e.g., along with theirrespective questions and/or a summary of the respective questions) to asecond set of one or more users (e.g., one or more privacy officers fromthe organization that is designing the product), for example, in theform a plurality of suitable question/answer pairings. As an aside,within the context of this specification, pairings of an answer andeither its respective question or a summary of the question may bereferred to as a “question/answer” pairing. As an example, the question“Is the data encrypted? and respective answer “Yes” may be represented,for example, in either of the following question/answer pairings: (1)“The data is encrypted”; and (2) “Data encrypted? Yes”. Alternatively,the question/answer pairing may be represented as a value in aparticular field in a data structure that would convey that the data atissue is encrypted.

The system then advances to Step 1912, where it receives, from thesecond set of users, one or more recommended steps to be implemented aspart of the proposed design of the product and before the implementationdate, the one or more recommended steps comprising one or more stepsthat facilitate the compliance of the product with the one or moreprivacy standards and/or policies. In particular embodiments in whichthe product is a software application or an electro-mechanical devicethat runs device software, the one or more recommended steps maycomprise modifying the software application or device software to complywith one or more privacy standards and/or policies.

Next, at Step 1914, in response to receiving the one or more recommendedsteps, the system automatically initiates the generation of one or moretasks in a second computer software application (e.g., projectmanagement software) that is to be used in managing the design of theproduct. In particular embodiments, the one or more tasks comprise oneor more tasks that, if completed, individually and/or collectively wouldresult in the completion of the one or more recommended steps.

The system then initiates a monitoring process for determining whetherthe one or more tasks have been completed. This step may, for example,be implemented by automatically monitoring which changes (e.g., edits tosoftware code) have been made to the product, or by receiving manualinput confirming that various tasks have been completed.

The system then advances to Step 1916, where it receives a notificationthat the at least one task has been completed. Next, at Step 1918, atleast partially in response to the first computer software applicationbeing provided with the notification that the task has been completed,the system generates an updated privacy assessment for the product thatreflects the fact that the task has been completed. The system maygenerate this updated privacy impact assessment automatically by, forexample, automatically modifying any answers from within thequestion/answer pairings of the initial impact privacy assessment toreflect any modifications to the product that have been made in thecourse of completing the one or more tasks that implement the one ormore substantive recommendations. For example, if a particular questionfrom the initial privacy impact assessment indicated that certainpersonal data was personally-identifiable data, and a recommendation wasmade to anonymize the data, the question/answer pairing for theparticular question could be revised so that the answer to the questionindicates that the data has been anonymized. Any revised question/answerpairings may then be used to complete an updated privacy assessmentreport.

As discussed above, the system may then analyze the one or morerevisions that have made to the product to determine whether the one ormore revisions substantively impact the product's compliance with one ormore privacy standards. Finally, the system generates aprivacy-by-design report that may, for example, include a listing of anyof the one or more revisions that have been made and that substantivelyimpact the product's compliance with one or more privacy standards.

In various embodiments, the privacy-by-design report may also comprise,for example, a log of data demonstrating that the business, in thenormal course of its operations: (1) conducts privacy impact assessmentson new products before releasing them; and (2) implements any changesneeded to comply with one or more privacy polies before releasing thenew products. Such logs may include data documenting the results of anyprivacy impact assessments conducted by the business (and/or anyparticular sub-part of the business) on new products before eachrespective new product's launch date, any revisions that the business(and/or any particular sub-part of the business) make to new productsbefore the launch of the product. The report may also optionally includethe results of any updated privacy impact assessments conducted onproducts after the products have been revised to comply with one or moreprivacy regulations and/or policies. The report may further include alisting of any changes that the business has made to particular productsin response to initial impact privacy assessment results for theproducts. The system may also list which of the listed changes weredetermined, by the system, to be substantial changes (e.g., that thechanges resulted in advancing the product's compliance with one or moreprivacy regulations).

Additional Aspects of System

1. Standardized and Customized Assessment of Vendors' Compliance WithPrivacy and/or Security Policies

In particular embodiments, the system may be adapted to: (1) facilitatethe assessment of one or more vendors' compliance with one or moreprivacy and/or security policies; and (2) allow organizations (e.g.,companies or other organizations) who do business with the vendors tocreate, view and/or apply customized criteria to informationperiodically collected by the system to evaluate each vendor'scompliance with one or more of the company's specific privacy and/orsecurity policies. In various embodiments, the system may also flag anyassessments, projects, campaigns, and/or data flows that theorganization has documented and maintained within the system if thosedata flows are associated with a vendor that has its rating changed sothat the rating meets certain criteria (e.g., if the vendor's ratingfalls below a predetermined threshold).

In particular embodiments:

-   -   The system may include an online portal and community that        includes a listing of all supported vendors.    -   An appropriate party (e.g., the participating vendor or a member        of the on-line community) may use the system to submit an        assessment template that is specific to a particular vendor.        -   If the template is submitted by the vendor itself, the            template may be tagged in any appropriate way as “official”        -   An instance for each organization using the system (i.e.,            customer) is integrated with this online community/portal so            that the various assessment templates can be directly fed            into that organization's instance of the system if the            organization wishes to use it.    -   Vendors may subscribe to a predetermined standardized assessment        format.        -   Assessment results may also be stored in the central            community/portal.        -   A third-party privacy and/or security policy compliance            assessor, on a schedule, may (e.g., periodically) complete            the assessment of the vendor.        -   Each organization using the system can subscribe to the            results (e.g., once they are available).        -   Companies can have one or more customized rules set up            within the system for interpreting the results of            assessments in their own unique way. For example:            -   Each customer can weight each question within an                assessment as desired and set up addition/multiplication                logic to determine an aggregated risk score that takes                into account the customized weightings given to each                question within the assessment.            -   Based on new assessment results—the system may notify                each customer if the vendor's rating falls, improves, or                passes a certain threshold.            -   The system can flag any assessments, projects,                campaigns, and/or data flows that the customer has                documented and maintained within the system if those                data flows are associated with a vendor that has its                rating changed.

2. Privacy Policy Compliance System That Facilitates Communications WithRegulators (Including Translation Aspect)

In particular embodiments, the system is adapted to interface with thecomputer systems of regulators (e.g., government regulatory agencies)that are responsible for approving privacy campaigns. This may, forexample, allow the regulators to review privacy campaign informationdirectly within particular instances of the system and, in someembodiments, approve the privacy campaigns electronically.

In various embodiments, the system may implement this concept by:

-   -   Exporting relevant data regarding the privacy campaign, from an        organization's instance of the system (e.g., customized version        of the system) in standardized format (e.g., PDF or Word) and        sending the extracted data to an appropriate regulator for        review (e.g., in electronic or paper format).        -   Either regular provides the format that the system codes to,            or the organization associated with the system provides a            format that the regulators are comfortable with.    -   Send secure link to regulator that gives them access to comment        and leave feedback        -   Gives the regulator direct access to the organization's            instance of the system with a limited and restricted view of            just the projects and associated audit and commenting logs            the organization needs reviewed.        -   Regulator actions are logged historically and the regulator            can leave guidance, comments, and questions, etc.    -   Have portal for regulator that securely links to the systems of        their constituents.

Details:

-   -   When submitted—the PIAs are submitted with requested        priority—standard or expedited.    -   DPA specifies how many expedited requests individuals are        allowed to receive.    -   Either the customer or DPA can flag a PIA or associated        comments/guidance on the PIA with “needs translation” and that        can trigger an automated or manual language translation.    -   Regulator could be a DPA “data protection authority” in any EU        country, or other country with similar concept like FTC in US,        or OPC in Canada.

3. Systems/Methods For Measuring the Privacy Maturity of a BusinessGroup Within an Organization.

In particular embodiments, the system is adapted for automaticallymeasuring the privacy of a business group, or other group, within aparticular organization that is using the system. This may provide anautomated way of measuring the privacy maturity, and one or more trendsof change in privacy maturity of the organization, or a selectedsub-group of the organization.

In various embodiments, the organization using the system can customizeone or more algorithms used by the system to measure the privacymaturity of a business group (e.g., by specifying one or more variablesand/or relative weights for each variable in calculating a privacymaturity score for the group). The following are examples of variablesthat may be used in this process:

-   -   Issues/Risks found in submitted assessments that are unmitigated        or uncaught prior to the assessment being submitted to the        privacy office        -   % of privacy assessments with high issues/total assessments        -   % with medium        -   % with low    -   Size and type of personal data used by the group        -   Total assessments done        -   Number of projects/campaigns with personal data        -   Amount of personal data        -   Volume of data transfers to internal and external parties    -   Training of the people in the group        -   Number or % of individuals who have watched training,            readings, or videos        -   Number or % of individuals who have completed quizzes or            games for privacy training        -   Number or % of individuals who have attended privacy events            either internally or externally        -   Number or % of individuals who are members of IAPP        -   Number or % of individuals who have been specifically            trained in privacy either internally or externally, formally            (IAPP certification) or informally        -   Usage of an online version of the system, or mobile training            or communication portal that customer has implemented    -   Other factors

4. Automated Assessment of Compliance (Scan App or Website to DetermineBehavior/Compliance With Privacy Policies)

In various embodiments, instead of determining whether an organizationcomplies with the defined parameters of a privacy campaign by, forexample, conducting an audit as described above (e.g., by asking usersto answer questions regarding the privacy campaign, such as “What iscollected” “what cookies are on your website”, etc.), the system may beconfigured to automatically determine whether the organization iscomplying with one or more aspects of the privacy policy.

For example, during the audit process, the system may obtain a copy of asoftware application (e.g., an “app”) that is collecting and/or usingsensitive user information, and then automatically analyze the app todetermine whether the operation of the app is complying with the termsof the privacy campaign that govern use of the app.

Similarly, the system may automatically analyze a website that iscollecting and/or using sensitive user information to determine whetherthe operation of the web site is complying with the terms of the privacycampaign that govern use of the web site.

In regard to various embodiments of the automatic application-analyzingembodiment referenced above:

-   -   The typical initial questions asked during an audit may be        replaced by a request to “Upload your app here”.        -   After the app is uploaded to the system, the system detects            what privacy permissions and data the app is collecting from            users.        -   This is done by having the system use static or behavioral            analysis of the application, or by having the system            integrate with a third-party system or software (e.g.,            Veracode), which executes the analysis.        -   During the analysis of the app, the system may detect, for            example, whether the app is using location services to            detect the location of the user's mobile device.        -   In response to determining that the app is collecting one or            more specified types of sensitive information (e.g., the            location of the user's mobile device), the system may            automatically request follow up information from the user by            posing one or more questions to the user, such as:            -   For what business reason is the data being collected?            -   How is the user's consent given to obtain the data?            -   Would users be surprised that the data is being                collected?            -   Is the data encrypted at rest and/or in motion?            -   What would happen if the system did not collect this                data? What business impact would it have?            -   In various embodiments, the system is adapted to allow                each organization to define these follow-up questions,                but the system asks the questions (e.g., the same                questions, or a customized list of questions) for each                privacy issue that is found in the app.        -   In various embodiments, after a particular app is scanned a            first time, when the app is scanned, the system may only            detect and analyze any changes that have been made to the            app since the previous scan of the app.        -   In various embodiments, the system is adapted to            (optionally) automatically monitor (e.g., continuously            monitor) one or more online software application            marketplaces (such as Microsoft, Google, or Apple's App            Store) to determine whether the application has changed. If            so, the system may, for example: (1) automatically scan the            application as discussed above; and (2) automatically notify            one or more designated individuals (e.g., privacy office            representatives) that an app was detected that the business            failed to perform a privacy assessment on prior to launching            the application.

In regard to various embodiments of the automatic application-analyzingembodiment referenced above:

-   -   The system prompts the user to enter the URL of the web site to        be analyzed, and, optionally, the URL to the privacy policy that        applies to the web site.    -   The system then scans the website for cookies, and/or other        tracking mechanisms, such as fingerprinting technologies and/or        3rd party SDKs.        -   The system may then optionally ask the user to complete a            series of one or more follow-up questions for each of these            items found during the scan of the website.        -   This may help the applicable privacy office craft a privacy            policy to be put on the website to disclose the use of the            tracking technologies and SDK's used on the website.    -   The system may then start a continuous monitoring of the website        site to detect whether any new cookies, SDKs, or tracking        technologies are used. In various embodiments, the system is        configured to, for example, generate an alert to an appropriate        individual (e.g., a designated privacy officer) to inform them        of the change to the website. The privacy officer may use this        information, for example, to determine whether to modify the        privacy policy for the website or to coordinate discontinuing        use of the new tracking technologies and/or SDK's.    -   In various embodiments, the system may also auto-detect whether        any changes have been made to the policy or the location of the        privacy policy link on the page and, in response to        auto-detecting such changes, trigger an audit of the project.    -   It should be understood that the above methods of automatically        assessing behavior and/or compliance with one or more privacy        policies may be done in any suitable way (e.g., ways other than        website scanning and app scanning). For example, the system may        alternatively, or in addition, automatically detect, scan and/or        monitor any appropriate technical system(s) (e.g., computer        system and/or system component or software), cloud services,        apps, websites and/or data structures, etc.

5. System Integration With DLP Tools.

DLP tools are traditionally used by information security professionals.Various DLP tools discover where confidential, sensitive, and/orpersonal information is stored and use various techniques toautomatically discover sensitive data within a particular computersystem—for example, in emails, on a particular network, in databases,etc. DLP tools can detect the data, what type of data, the amount ofdata, and whether the data is encrypted. This may be valuable forsecurity professionals, but these tools are typically not useful forprivacy professionals because the tools typically cannot detect certainprivacy attributes that are required to be known to determine whether anorganization is in compliance with particular privacy policies.

For example, traditional DLP tools cannot typically answer the followingquestions:

-   -   Who was the data collected from (data subject)?    -   Where are those subjects located?    -   Are they minors?    -   How was consent to use the data received?    -   What is the use of the data?    -   Is the use consistent with the use specified at the time of        consent?    -   What country is the data stored in and/or transferred to?    -   Etc.

-   In various embodiments, the system is adapted to integrate with    appropriate DLP and/or data discovery tools (e.g., INFORMATICA) and,    in response to data being discovered by those tools, to show each    area of data that is discovered as a line-item in a system screen    via integration.    -   The system may do this, for example, in a manner that is similar        to pending transactions in a checking account that have not yet        been reconciled.

-   A designated privacy officer may then select one of those—and either    match it up (e.g., reconcile it) with an existing data flow or    campaign in the system OR trigger a new assessment to be done on    that data to capture the privacy attributes and data flow.

6. System For Generating an Organization's Data Map by Campaign, bySystem, or by Individual Data Attributes.

In particular embodiments, the system may be adapted to allow users tospecify various criteria, and then to display, to the user, any datamaps that satisfy the specified criteria. For example, the system may beadapted to display, in response to an appropriate request: (1) all of aparticular customer's data flows that are stored within the system; (2)all of the customer's data flows that are associated with a particularcampaign; and/or (3) all of the customer's data flows that involve aparticular address.

Similarly, the system may be adapted to allow privacy officers todocument and input the data flows into the system in any of a variety ofdifferent ways, including:

-   -   Document by process        -   The user initiates an assessment for a certain business            project and captures the associated data flows (including            the data elements related to the data flows and the systems            they are stored in).    -   Document by element        -   The user initiates an audit of a data element—such as            SSN—and tries to identify all data structures associated            with the organization that include the SSN. The system may            then document this information (e.g., all of the            organization's systems and business processes that involve            the business processes.)    -   Document by system        -   The user initiates an audit of a database, and the system            records, in memory, the results of the audit.

7. Privacy Policy Compliance System That Allows Users to Attach Emailsto Individual Campaigns.

Privacy officers frequently receive emails (or other electronicmessages) that are associated with an existing privacy assessment orcampaign, or a potential future privacy assessment. For record keepingand auditing purposes, the privacy officer may wish to maintain thoseemails in a central storage location, and not in email. In variousembodiments, the system is adapted to allow users to automaticallyattach the email to an existing privacy assessment, data flow, and/orprivacy campaign. Alternatively or additionally, the system may allow auser to automatically store emails within a data store associated withthe system, and to store the emails as “unassigned”, so that they maylater be assigned to an existing privacy assessment, data flow, and/orprivacy campaign.

-   -   In various embodiments, the system is adapted to allow a user to        store an email using:        -   a browser plugin-extension that captures webmail;        -   a Plug-in directly with office 365 or google webmail (or            other suitable email application);        -   a Plug-in with email clients on computers such as Outlook;        -   via an integrated email alias that the email is forwarded            to; or        -   any other suitable configuration

8. Various Aspects of Related Mobile Applications

In particular embodiments, the system may use a mobile app (e.g., thatruns on a particular mobile device associated by a user) to collect datafrom a user. The mobile app may be used, for example, to collect answersto screening questions. The app may also be adapted to allow users toeasily input data documenting and/or reporting a privacy incident. Forexample, the app may be adapted to assist a user in using their mobiledevice to capture an image of a privacy incident (e.g., a screen shotdocumenting that data has been stored in an improper location, or that aprintout of sensitive information has been left in a public workspacewithin an organization.)

The mobile app may also be adapted to provide incremental training toindividuals. For example, the system may be adapted to provideincremental training to a user (e.g., in the form of the presentation ofshort lessons on privacy). Training sessions may be followed by shortquizzes that are used to allow the user to assess their understanding ofthe information and to confirm that they have completed the training.

9. Automatic Generation of Personal Data Inventory For Organization

In particular embodiments, the system is adapted to generate and displayan inventory of the personal data that an organization collects andstores within its systems (or other systems). As discussed above, invarious embodiments, the system is adapted to conduct privacy impactassessments for new and existing privacy campaigns. During a privacyimpact assessment for a particular privacy campaign, the system may askone or more users a series of privacy impact assessment questionsregarding the particular privacy campaign and then store the answers tothese questions in the system's memory, or in memory of another system,such a third-party computer server.

Such privacy impact assessment questions may include questionsregarding: (1) what type of data is to be collected as part of thecampaign; (2) who the data is to be collected from; (3) where the datais to be stored; (4) who will have access to the data; (5) how long thedata will be kept before being deleted from the system's memory orarchived; and/or (6) any other relevant information regarding thecampaign.

The system may store the above information, for example, in any suitabledata structure, such as a database. In particular embodiments, thesystem may be configured to selectively (e.g., upon request by anauthorized user) generate and display a personal data inventory for theorganization that includes, for example, all of the organization'scurrent active campaigns, all of the organization's current and pastcampaigns, or any other listing of privacy campaigns that, for example,satisfy criteria specified by a user. The system may be adapted todisplay and/or export the data inventory in any suitable format (e.g.,in a table, a spreadsheet, or any other suitable format).

10. Integrated/Automated Solution For Privacy Risk Assessments

Continuing with Concept 9, above, in various embodiments, the system mayexecute multiple integrated steps to generate a personal data inventoryfor a particular organization. For example, in a particular embodiment,the system first conducts a Privacy Threshold Assessment (PTA) by askinga user a relatively short set of questions (e.g., between 1 and 15questions) to quickly determine whether the risk associated with thecampaign may potentially exceed a pre-determined risk threshold (e.g.,whether the campaign is a potentially high-risk campaign). The systemmay do this, for example, by using any of the above techniques to assigna collective risk score to the user's answers to the questions anddetermining whether the collective risk score exceeds a particular riskthreshold value. Alternatively, the system may be configured todetermine that the risk associated with the campaign exceeds the riskthreshold value if the user answers a particular one or more of thequestions in a certain way.

The system may be configured for, in response to the user's answers toone or more of the questions within the Privacy Threshold Assessmentindicating that the campaign exceeds, or may potentially exceed, apre-determined risk threshold, presenting the user with a longer set ofdetailed questions regarding the campaign (e.g., a Privacy ImpactAssessment). The system may then use the user's answers to this longerlist of questions to assess the overall risk of the campaign, forexample, as described above.

In particular embodiments, the system may be configured for, in responseto the user's answers to one or more of the questions within the PrivacyThreshold Assessment indicating that the campaign does not exceed, ordoes not potentially exceed, a pre-determined risk threshold, notpresenting the user with a longer set of detailed questions regardingthe campaign (e.g., a Privacy Impact Assessment). In such a case, thesystem may simply save an indication to memory that the campaign is arelatively low risk campaign.

Accordingly, in particular embodiments, the system may be adapted toautomatically initiate a Privacy Impact Assessment if the results of ashorter Privacy Threshold Assessment satisfy certain criteria.Additionally, or alternatively, in particular embodiments, the systemmay be adapted to allow a privacy officer to manually initiate a PrivacyImpact Assessment for a particular campaign.

In particular embodiments, built into the Privacy Threshold Assessmentand the Privacy

Impact Assessment are the data mapping questions and/or sub-questions ofhow the personal data obtained through the campaign will be collected,used, stored, accessed, retained, and/or transferred, etc. In particularembodiments: (1) one or more of these questions are asked in the PrivacyThreshold Assessment; and (2) one or more of the questions are asked inthe Privacy Impact Assessment. In such embodiments, the system mayobtain the answers to each of these questions, as captured during thePrivacy Threshold Assessment and the Privacy Impact Assessment, and thenuse the respective answers to generate the end-to-end data flow for therelevant privacy campaign.

The system may then link all of the data flows across all of theorganization's privacy campaigns together in order to show a completeevergreen version of the personal data inventory of the organization.Thus, the system may efficiently generate the personal data inventory ofan organization (e.g., through the use of reduced computer processingpower) by automatically gathering the data needed to prepare thepersonal data inventory while conducting Privacy Threshold Assessmentsand Privacy Impact Assessments.

System For Preventing Individuals From Trying to Game the System

As discussed above, in particular embodiments, the system is adapted todisplay a series of threshold questions for particular privacy campaignsand to use conditional logic to assess whether to present additional,follow-up questions to the user. There may, for example, be situationsin which a user may answer, or attempt to answer, one or more of thethreshold questions incorrectly (e.g., dishonestly) in an attempt toavoid needing to answer additional questions. This type of behavior canpresent serious potential problems for the organization because thebehavior may result in privacy risks associated with a particularprivacy campaign being hidden due to the incorrect answer or answers.

To address this issue, in various embodiments, the system maintains ahistorical record of every button press (e.g., un-submitted systeminput) that an individual makes when a question is presented to them. Inparticular embodiments, actively monitoring the user's system inputs mayinclude, for example, monitoring, recording, tracking, and/or otherwisetaking account of the user's system inputs. These system inputs mayinclude, for example: (1) one or more mouse inputs; (2) one or morekeyboard (e.g., text) inputs); (3) one or more touch inputs; and/or (4)any other suitable inputs (e.g., such as one or more vocal inputs,etc.). In various embodiments, the system is configured to activelymonitor the user's system inputs, for example: (1) while the user isviewing one or more graphical user interfaces for providing informationregarding or responses to questions regarding one or more privacycampaigns; (2) while the user is logged into a privacy portal; and/or(3) in any other suitable situation related to the user providinginformation related to the collection or storage of personal data (e.g.,in the context of a privacy campaign). Additionally, the system tracks,and saves to memory, each incidence of the individual changing theiranswer to a question (e.g., (a) before formally submitting the answer bypressing an “enter” key, or other “submit” key on a user interface, suchas a keyboard or graphical user interface on a touch-sensitive displayscreen; or (b) after initially submitting the answer).

The system may also be adapted to automatically determine whether aparticular question (e.g., threshold question) is a “critical” questionthat, if answered in a certain way, would cause the conditional logictrigger to present the user with one or more follow-up questions. Forexample, the system may, in response to receiving the user's full set ofanswers to the threshold questions, automatically identify anyindividual question within the series of threshold questions that, ifanswered in a particular way (e.g., differently than the user answeredthe question) would have caused the system to display one or more followup questions. The system may then flag those identified questions, inthe system's memory, as “critical” questions.

Alternatively, the system may be adapted to allow a user (e.g., aprivacy officer of an organization) who is drafting a particularthreshold question that, when answered in a particular way, willautomatically trigger the system to display one or more follow upquestions to the user, to indicate that is a “critical” thresholdquestion. The system may then save this “critical” designation of thequestion to the system's computer memory.

In various embodiments, the system is configured, for any questions thatare deemed “critical” (e.g., either by the system, or manually, asdiscussed above), to determine whether the user exhibited any abnormalbehavior when answering the question. For example, the system may checkto see whether the user changed their answer once, or multiple times,before submitting their answer to the question (e.g., by tracking theuser's keystrokes while they are answering the threshold question, asdescribed above). As another example, the system may determine whetherit took the user longer than a pre-determined threshold amount of time(e.g., 5 minutes, 3 minutes, etc. . . . ) to answer the criticalthreshold question.

In particular embodiments, the system may be adapted, in response todetermining that the user exhibited abnormal behavior when answering thecritical threshold question, to automatically flag the thresholdquestion and the user's answer to that question for later follow up by adesignated individual or team (e.g., a member of the organization'sprivacy team). In particular embodiments, the system may also, oralternatively, be adapted to automatically generate and transmit amessage to one or more individuals (e.g., the organization's chiefprivacy officer) indicating that the threshold question may have beenanswered incorrectly and that follow-up regarding the question may beadvisable. After receiving the message, the individual may, inparticular embodiments, follow up with the individual who answered thequestion, or conduct other additional research, to determine whether thequestion was answered accurately.

In particular embodiments, the system is configured to monitor a user'scontext as the user provides responses for a computerized privacyquestionnaire. The user context may take in to account a multitude ofdifferent user factors to incorporate information about the user'ssurroundings and circumstances. One user factor may be the amount oftime a user takes to respond to one or more particular questions or thecomplete computerized privacy questionnaire. For example, if the userrushed through the computerized privacy questionnaire, the system mayindicate that user abnormal behavior occurred in providing the one ormore responses. In some implementations, the system may include athreshold response time for each question of the computerized privacyquestionnaire (e.g., this may be a different threshold response time foreach question) or the complete computerized privacy questionnaire. Thesystem may compare the response time for each of the one or moreresponses to its associated threshold response time, and/or the systemmay compare the response time for completion of the computerized privacyquestionnaire to the associated threshold response time for completionof the full computerized privacy questionnaire. The system may beconfigured to indicate that user abnormal behavior occurred in providingthe one or more responses when either the response time is a longerperiod of time (e.g., perhaps indicating that the user is beingdishonest) or shorter period of time (e.g., perhaps indicating that theuser is rushing through the computerized privacy questionnaire and theresponses may be inaccurate) than the threshold response time.

Another user factor may be a deadline for initiation or completion ofthe computerized privacy questionnaire. For example, if the userinitiated or completed the computerized privacy questionnaire after aparticular period of time (e.g., an initiation time or a completiontime), the system may indicate that user abnormal behavior occurred inproviding the one or more responses. The certain period of time may bepreset, user-defined, and/or adjusted by the user, and may be athreshold time period. Additionally, in some implementations, the userfactors may be adjusted based on one another. For example, if the userinitiated the computerized privacy questionnaire close to a deadline forthe computerized privacy questionnaire, then the threshold response timefor each question of the computerized privacy questionnaire or thecomplete computerized privacy questionnaire may be modified (e.g., thethreshold response time may be increased to ensure that the user doesnot rush through the privacy questionnaire close to the deadline).

Additionally, another user factor may incorporate a location in whichthe user conducted the privacy questionnaire. For example, if the userconducted the privacy questionnaire in a distracting location (e.g., atthe movies or airport), the system may indicate that user abnormalbehavior occurred. The system may use GPS tracking data associated withthe electronic device (e.g., laptop, smart phone) on which the userconducted the privacy questionnaire to determine the location of theuser. The system may include one or more particular locations or typesof locations that are designated as locations in which the user may bedistracted, or otherwise provide less accurate results. The locationsmay be specific to each user or the same locations for all users, andthe locations may be adjusted (e.g., added, removed, or otherwisemodified). The types of locations may be locations such as restaurants,entertainment locations, mass transportation points (e.g., airports,train stations), etc.

In particular embodiments, the system is configured to determine a typeof connection via which the user is accessing the questionnaire. Forexample, the system may determine that the user is accessing thequestionnaire while connect to a public wireless network (e.g., at anairport, coffee shop, etc.). The system may further determine that theuser is connect to a wireless or other network such as a home network(e.g., at the user's house). In such examples, the system may determinethat the user may be distracted based on a location inferred based onone or more connections identified for the computing device via whichthe user is accessing the questionnaire. In other embodiments, thesystem may determine that the user is connect via a company network(e.g., a network associated with the entity providing the questionnairefor completion). In such embodiments, the system may be configured todetermine that the user is focused on the questionnaire (e.g., by virtueof the user being at work while completing it).

Moreover, another user factor may involve determining the electronicactivities the user is performing on the user's electronic device whilethey are completing the privacy questionnaire. This factor may also berelated to determining if the user is distracted when completing theprivacy questionnaire. For example, the system may determine whether theuser interacted, on the electronic device, with one or more web browsersor software applications that are unrelated to conducting thecomputerized privacy questionnaire (e.g., by determining whether theuser accessed one or more other active browsing windows, or whether abrowsing window in which the user is completing the questionnairebecomes inactive while the user us completing it). If the systemdetermines that such unrelated electronic activities were interactedwith, the system may indicate that user abnormal behavior occurred incompleting the privacy questionnaire. Further, the electronic activitiesmay be preset, user-specific, and/or modified. The user factors aboveare provided by way of example, and more, fewer, or different userfactors may be included as part of the system. In some embodiments, thesystem may incorporate the user's electronic device camera to determineif the user is exhibiting abnormal behavior (e.g., pupilsdilated/blinking a lot could indicate deception in responding to theprivacy questionnaire).

In some implementations, the system may use one or more of the userfactors to calculate a user context score. Each of the user factors mayinclude a user factor rating to indicate a likelihood that user abnormalbehavior occurred with respect to that particular user factor. The usercontext score may be calculated based on each of the user factorratings. In some embodiments, a weighting factor may be applied to eachuser factor (e.g., this may be specific for each organization) for thecalculation of the user context score. Additionally, in someembodiments, if one or more user factor ratings is above a certainrating (i.e., indicating a very likelihood of user abnormal behavior forthat particular user factor), then the user context score mayautomatically indicate that user abnormal behavior occurred incompleting the privacy questionnaire. The user context score may becompared to a threshold user context score that may be preset, user ororganization defined, and/or modified. If the system determines that theuser context score is greater than the threshold user context score(i.e., indicates a higher likelihood of user abnormal behavior than thelikelihood defined by threshold), then the system may indicate that userabnormal behavior occurred in conducting the privacy questionnaire.

In some implementations, the submitted input of the user to one or moreresponses may include a particular type of input that may cause thesystem to provide one or more follow up questions. The follow upquestions may be provided for the user justify the particular type ofinput response that was provided. The particular type of input may beresponses that are indefinite, indicate the user is unsure of theappropriate response (e.g., “I do not know”), or intimate that the useris potentially being untruthful in the response. For example, if theuser provides a response of “I do not know” (e.g., by selecting in alist or inputting in a text box), the system may be configured toprovided one or more follow up questions to further determine why theuser “does not know” the answer to the specific inquiry or if the useris being truthful is saying they “do not know.”

In some implementations, the system may, for each of the one or moreresponses to one or more questions in the computerized privacyquestionnaire, determine a confidence factor score. The confidencefactor score may be based on the user context of the user as the userprovides the one or more responses and/or the one or more system inputsfrom the user the comprise the one or more responses. For example, ifthe user was in a distracting environment when the user provided aparticular response in the privacy questionnaire and/or the userprovided one or more unsubmitted inputs prior to providing the submittedinput for the particular response, the system may calculate a lowconfidence factor score for the particular response.

Further, the system may calculate a confidence score for thecomputerized privacy questionnaire based at least in part on theconfidence factor score for each of the one or more responses to one ormore questions in the computerized privacy questionnaire. Uponcalculating the confidence score, the system can use the confidencescore to determine whether user abnormal behavior occurred in providingthe one or more responses. In some implementations, a low confidencefactor score for a single response may cause the confidence score of theprivacy questionnaire to automatically indicate user abnormal behavioroccurred in providing the privacy questionnaire. However, in otherembodiments, this is not the case. For example, if only two out oftwenty confidence factor scores are very low (i.e., indicate a higherlikelihood of user abnormal behavior in providing the particularresponse), the system may determine, based on the calculated confidencescore for the privacy questionnaire, that user abnormal behavior did notoccur in completing the privacy questionnaire.

Privacy Assessment Monitoring Module

In particular embodiments, a Privacy Assessment Monitoring Module 2000is configured to: (1) monitor user inputs when the user is providinginformation related to a privacy campaign or completing a privacy impactassessment; and (2) determine, based at least in part on the userinputs, whether the user has provided one or more abnormal inputs orresponses. In various embodiments, the Privacy Assessment MonitoringModule 300 is configured to determine whether the user is, or may be,attempting to provide incomplete, false, or misleading information orresponses related to the creation of a particular privacy campaign, aprivacy impact assessment associated with a particular privacy campaign,etc.

Turning to FIG. 20, in particular embodiments, when executing thePrivacy Assessment Monitoring Module 2000, the system begins, at Step2010, by receiving an indication that a user is submitting one or moreresponses to one or more questions related to a particular privacycampaign. In various embodiments, the system is configured to receivethe indication in response to a user initiating a new privacy campaign(e.g., on behalf of a particular organization, sub-group within theorganization, or other suitable business unit). In other embodiments,the system is configured to receive the indication while a particularuser is completing a privacy impact assessment for a particular privacycampaign, where the privacy impact assessment provides oversight intovarious aspects of the particular privacy campaign such as, for example:(1) what personal data is collected as part of the privacy campaign; (2)where the personal data is stored; (3) who has access to the storedpersonal data; (4) for what purpose the personal data is collected, etc.

In various embodiments, the system is configured to receive theindication in response to determining that a user has accessed a privacycampaign initiation system (e.g., or other privacy system) and isproviding one or more pieces of information related to a particularprivacy campaign. In particular embodiments, the system is configured toreceive the indication in response to the provision, by the user, of oneor more responses as part of a privacy impact assessment. In variousembodiments, the system is configured to receive the indication inresponse to any suitable stimulus in any situation in which a user mayprovide one or more potentially abnormal responses to one or morequestions related to the collection, storage or use of personal data.

In various embodiments, the privacy campaign may be associated with anelectronic record (e.g., or any suitable data structure) comprisingprivacy campaign data. In particular embodiments, the privacy campaigndata comprises a description of the privacy campaign, one or more typesof personal data related to the campaign, a subject from which thepersonal data is collected as part of the privacy campaign, a storagelocation of the personal data (e.g., including a physical location ofphysical memory on which the personal data is stored), one or moreaccess permissions associated with the personal data, and/or any othersuitable data associated with the privacy campaign. In variousembodiments, the privacy campaign data is provided by a user of thesystem.

An exemplary privacy campaign, project, or other activity may include,for example: (1) a new IT system for storing and accessing personal data(e.g., include new hardware and/or software that makes up the new ITsystem; (2) a data sharing initiative where two or more organizationsseek to pool or link one or more sets of personal data; (3) a proposalto identify people in a particular group or demographic and initiate acourse of action; (4) using existing data for a new and unexpected ormore intrusive purpose; and/or (5) one or more new databases whichconsolidate information held by separate parts of the organization. Instill other embodiments, the particular privacy campaign, project orother activity may include any other privacy campaign, project, or otheractivity discussed herein, or any other suitable privacy campaign,project, or activity.

During a privacy impact assessment for a particular privacy campaign, aprivacy impact assessment system may ask one or more users (e.g., one ormore individuals associated with the particular organization orsub-group that is undertaking the privacy campaign) a series of privacyimpact assessment questions regarding the particular privacy campaignand then store the answers to these questions in the system's memory, orin memory of another system, such as a third-party computer server.

Such privacy impact assessment questions may include questionsregarding, for example: (1) what type of data is to be collected as partof the campaign; (2) who the data is to be collected from; (3) where thedata is to be stored; (4) who will have access to the data; (5) how longthe data will be kept before being deleted from the system's memory orarchived; and/or (6) any other relevant information regarding thecampaign. In various embodiments a privacy impact assessment system maydetermine a relative risk or potential issues with a particular privacycampaign as it related to the collection and storage of personal data.For example, the system may be configured to identify a privacy campaignas being “High” risk, “Medium” risk, or “Low” risk based at least inpart on answers submitted to the questions listed above. For example, aPrivacy Impact Assessment that revealed that credit card numbers wouldbe stored without encryption for a privacy campaign would likely causethe system to determine that the privacy campaign was high risk.

As may be understood in light of this disclosure, a particularorganization may implement operational policies and processes thatstrive to comply with industry best practices and legal requirements inthe handling of personal data. In various embodiments, the operationalpolicies and processes may include performing privacy impact assessments(e.g., such as those described above) by the organization and/or one ormore sub-groups within the organization. In particular embodiments, oneor more individuals responsible for completing a privacy impactassessment or providing privacy campaign data for a particular privacycampaign may attempt to provide abnormal, misleading, or otherwiseincorrect information as part of the privacy impact assessment. In suchembodiments, the system may be configured to receive the indication inresponse to receiving an indication that a user has initiated or isperforming a privacy impact assessment.

Returning to Step 2020, the system is configured to, in response toreceiving the indication at Step 310, monitor (e.g., actively monitor)the user's system inputs. In particular embodiments, actively monitoringthe user's system inputs may include, for example, monitoring,recording, tracking, and/or otherwise taking account of the user'ssystem inputs. These system inputs may include, for example: (1) one ormore mouse inputs; (2) one or more keyboard (e.g., text) inputs); (3)one or more touch inputs; and/or (4) any other suitable inputs (e.g.,such as one or more vocal inputs, etc.). In various embodiments, thesystem is configured to actively monitor the user's system inputs, forexample: (1) while the user is viewing one or more graphical userinterfaces for providing information regarding or responses to questionsregarding one or more privacy campaigns; (2) while the user is loggedinto a privacy portal; and/or (3) in any other suitable situationrelated to the user providing information related to the collection orstorage of personal data (e.g., in the context of a privacy campaign).In other embodiments, the system is configured to monitor one or morebiometric indicators associated with the user such as, for example,heart rate, pupil dilation, perspiration rate, etc.

In particular embodiments, the system is configured to monitor a user'sinputs, for example, by substantially automatically tracking a locationof the user's mouse pointer with respect to one or more selectableobjects on a display screen of a computing device. In particularembodiments, the one or more selectable objects are one or moreselectable objects (e.g., indicia) that make up part of a particularprivacy impact assessment, privacy campaign initiation system, etc. Instill other embodiments, the system is configured to monitor a user'sselection of any of the one or more selectable objects, which mayinclude, for example, an initial selection of one or more selectableobjects that the user subsequently changes to selection of a differentone of the one or more selectable objects.

In any embodiment described herein, the system may be configured tomonitor one or more keyboard inputs (e.g., text inputs) by the user thatmay include, for example, one or more keyboard inputs that the userenters or one or more keyboard inputs that the user enters but deleteswithout submitting. For example, a user may type an entry relating tothe creation of a new privacy campaign in response to a prompt that askswhat reason a particular piece of personal data is being collected for.The user may, for example, initially begin typing a first response, butdelete the first response and enter a second response that the userultimately submits. In various embodiments of the system describedherein, the system is configured to monitor the un-submitted firstresponse in addition to the submitted second response.

In still other embodiments, the system is configured to monitor a user'slack of input. For example, a user may mouse over a particular inputindicia (e.g., a selection from a drop-down menu, a radio button orother selectable indicia) without selecting the selection or indicia. Inparticular embodiments, the system is configured to monitor such inputs.As may be understood in light of this disclosure, a user that mousesover a particular selection and lingers over the selection withoutactually selecting it may be contemplating whether to: (1) provide amisleading response; (2) avoid providing a response that they likelyshould provide in order to avoid additional follow up questions; and/or(3) etc.

In other embodiments, the system is configured to monitor any othersuitable input by the user. In various embodiments, this may include,for example: (1) monitoring one or more changes to an input by a user;(2) monitoring one or more inputs that the user later removes ordeletes; (3) monitoring an amount of time that the user spends providinga particular input; and/or (4) monitoring or otherwise tracking anyother suitable information related to the user's response to aparticular question and/or provision of a particular input to thesystem.

Retuning to Step 2030, the system is configured to store, in memory, arecord of the user's submitted and un-submitted system inputs. Asdiscussed above, the system may be configured to actively monitor bothsubmitted and un-submitted inputs by the user. In particularembodiments, the system is configured to store a record of those inputsin computer memory (e.g., in the One or More Databases 140 shown in FIG.1). In particular embodiments, storing the user's submitted andun-submitted system inputs may include, for example, storing a recordof: (1) each system input made by the user; (2) an amount of time spentby the user in making each particular input; (3) one or more changes toone or more inputs made by the user; (4) an amount of time spent by theuser to complete a particular form or particular series of questionsprior to submission; and/or (5) any other suitable information relatedto the user's inputs as they may relate to the provision of informationrelated to one or more privacy campaigns.

Continuing to Step 2040, the system is configured to analyze the user'ssubmitted and un-submitted inputs to determine one or more changes tothe user's inputs prior to submission. In particular embodiments, thesystem may, for example: (1) compare a first text input with a secondtext input to determine one or more differences, where the first textinput is an unsubmitted input and the second text input is a submittedinput; (2) determine one or more changes in selection, by the user, of auser-selectable input indicia (e.g., including a number of times theuser changed a selection); and/or (3) compare any other system inputs bythe user to determine one or more changes to the user's responses to oneor more questions prior to submission. In various embodiments, thesystem is configured to determine whether the one or more changesinclude one or more changes that alter a meaning of the submitted andunsubmitted inputs.

In various embodiments, the system is configured to compare first,unsubmitted text input with second, submitted text input to determinewhether the content of the second text input differs from the first textinput in a meaningful way. For example, a user may modify the wording oftheir text input without substantially modifying the meaning of theinput (e.g., to correct spelling, utilize one or more synonyms, correctpunctuation, etc.). In this example, the system may determine that theuser has not made meaningful changes to their provided input.

In another example, the system may determine that the user has changedthe first input to the second input where the second input has a meaningthat differs from a meaning of the first input. For example, the firstand second text inputs may: (1) list one or more different individuals;(2) list one or more different storage locations; (3) include one ormore words with opposing meanings (e.g., positive vs. negative, shortvs. long, store vs. delete, etc.); and/or (4) include any otherdiffering text that may indicate that the responses provided (e.g., thefirst text input and the second text input) do not have essentially thesame meaning. In this example, the system may determine that the userhas made one or more changes to the user's inputs prior to submission.

Returning to Step 2050, the system continues by determining, based atleast in part on the user's system inputs and the one or more changes tothe user's inputs, whether the user has provided one or more abnormalresponses to the one or more questions. In various embodiments, thesystem is configured to determine whether the user has provided one ormore abnormal responses to the one or more questions based ondetermining, at Step 2040, that the user has made one or more changes toa response prior to submitting the response (e.g., where the one or morechanges alter a meaning of the response).

In other embodiments, the system is configured to determine that theuser has provided one or more abnormal responses based on determiningthat the user took longer than a particular amount of time to provide aparticular response. For example, the system may determine that the userhas provided an abnormal response in response to the user taking longerthan a particular amount of time (e.g., longer than thirty seconds,longer than one minute, longer than two minutes, etc.) to answer asimple multiple choice question (e.g., “Will the privacy campaigncollect personal data for customers or employees?”).

In particular embodiments, the system is configured to determine thatthe user has provided one or more abnormal responses based on a numberof times that the user has changed a response to a particular question.For example, the system may determine a number of different selectionsmade by the user when selecting one or more choices from a drop downmenu prior to ultimately submitting a response. In another example, thesystem may determine a number of times the user changed their free-formtext entry response to a particular question. In various embodiments,the system is configured to determine that the user provided one or moreabnormal responses in response to determining that the user changedtheir response to a particular question more than a threshold number oftimes (e.g., one time, two times, three times, four times, five times,etc.).

In still other embodiments, the system is configured to determine thatthe user has provided one or more abnormal responses based at least inpart on whether a particular question (e.g., threshold question) is a“critical” question. In particular embodiments, a critical question mayinclude a question that, if answered in a certain way, would cause thesystem's conditional logic trigger to present the user with one or morefollow-up questions. For example, the system may, in response toreceiving the user's full set of answers to the threshold questions,automatically identify any individual question within the series ofthreshold questions that, if answered in a particular way (e.g.,differently than the user answered the question) would have caused thesystem to display one or more follow up questions.

In various embodiments, the system is configured, for any questions thatare deemed “critical” (e.g., either by the system, or manually) todetermine whether the user exhibited any abnormal behavior whenanswering the question. For example, the system may check to see whetherthe user changed their answer once, or multiple times, before submittingtheir answer to the question (e.g., by tracking the user's keystrokes orother system inputs while they are answering the threshold question, asdescribed above). As another example, the system may determine whetherit took the user longer than a pre-determined threshold amount of time(e.g., 5 minutes, 3 minutes, etc.) to answer the critical thresholdquestion.

In particular embodiments, the system is configured to determine whetherthe user provided one or more abnormal responses based on any suitablecombination of factors described herein including, for example: (1) oneor more changes to a particular response; (2) a number of changes to aparticular response; (3) an amount of time it took to provide theparticular response; (4) whether the response is a response to acritical question; and/or (5) any other suitable factor.

Continuing to Step 2060, the system, in response to determining that theuser has provided one or more abnormal responses, automatically flagsthe one or more questions in memory. In particular embodiments, thesystem is configured to automatically flag the one or more questions inmemory by associating the one or more questions in memory with a listingor index of flagged questions. In other embodiments, the system, inresponse to flagging the one or more questions, is further configured togenerate a notification and transmit the notification to any suitableindividual. For example, the system may transmit a notification that oneor more question have been flagged by a particular privacy officer orother individual responsible ensuring that a particular organization'scollection and storage of personal data meets one or more legal orindustry standards.

In particular embodiments, the system is configured to generate a reportof flagged questions related to a particular privacy campaign. Invarious embodiments, flagging the one or more questions is configured toinitiate a follow up by a designated individual or team (e.g., a memberof the organization's privacy team) regarding the one or more questions.In particular embodiments, the system may also, or alternatively, beadapted to automatically generate and transmit a message to one or moreindividuals (e.g., the organization's chief privacy officer) indicatingthat the threshold question may have been answered incorrectly and thatfollow-up regarding the question may be advisable. After receiving themessage, the individual may, in particular embodiments, follow up withthe individual who answered the question, or conduct other additionalresearch, to determine whether the question was answered accurately.

Privacy Assessment Modification Module

In particular embodiments, a Privacy Assessment Modification Module 2100is configured to modify a questionnaire to include at least oneadditional question in response to determining that a user has providedone or more abnormal inputs or responses regarding a particular privacycampaign. For example, the system may, as discussed above, prompt theuser to answer one or more follow up questions in response todetermining that the user gave an abnormal response to a criticalquestion. In particular embodiments, modifying the questionnaire toinclude one or more additional questions may prompt the user to providemore accurate responses which may, for example, limit a likelihood thata particular privacy campaign may run afoul of legal or industry-imposedrestrictions on the collection and storage of personal data.

Turning to FIG. 21, in particular embodiments, when executing thePrivacy Assessment Modification Module 2100, the system begins, at Step2110, by receiving an indication that a user has provided one or moreabnormal inputs or responses to one or more questions during acomputerized privacy assessment questionnaire. In particularembodiments, the system is configured to receive the indication inresponse to determining that the user has provided one or more abnormalresponses to one or more questions as part of Step 2050 of the PrivacyAssessment Monitoring Module 2000 described above.

Continuing to Step 2120, in response to receiving the indication, thesystem is configured to flag the one or more questions and modify thequestionnaire to include at least one additional question based at leastin part on the one or more questions. In various embodiments, the systemis configured to modify the questionnaire to include at least one followup question that relates to the one or more questions for which the userprovided one or more abnormal responses. For example, the system maymodify the questionnaire to include one or more follow up questions thatthe system would have prompted the user to answer if the user hadsubmitted a response that the user had initially provided but notsubmitted. For example, a user may have initially provided a responsethat social security numbers would be collected as part of a privacycampaign but deleted that response prior to submitting what sort ofpersonal data would be collected. The system may, in response todetermining that the user had provided an abnormal response to thatquestion, modify the questionnaire to include one or more additionalquestions related to why social security numbers would need to becollected (or to double check that they, in fact, would not be).

In other embodiments, the system is configured to take any othersuitable action in response to determining that a user has provided oneor more abnormal responses. The system may, for example: (1)automatically modify a privacy campaign; (2) flag a privacy campaign forreview by one or more third party regulators; and/or (3) perform anyother suitable action.

Automated Vendor Risk Compliance Assessment Systems and Related Methods

In particular embodiments, a vendor risk scanning system is configuredto scan one or more webpages (or any other suitable electronic medium)associated with a particular vendor (e.g., provider of particularsoftware, etc.) in order to identify one or more vendor attributes. Inparticular embodiments, the system may be configured to scan the one ormore web pages to identify one or more vendor attributes such as, forexample: (1) one or more security certifications that the vendor does ordoes not have and/or claim to have (e.g., ISO 27001, SOC II Type 2,etc.); (2) one or more awards and/or recognitions that the vendor hasreceived and/or claims to have received (e.g., one or more securityawards); (3) one or more security policies and/or third-party vendors;(4) one or more privacy policies and/or cookie policies for the one ormore webpages; (5) one or more key partners or potential third-partyprocessors (e.g., sub-processors) of one or more services associatedwith the vendor; and/or (6) any other suitable vendor attribute. Othersuitable vendor attributes may include, for example, membership in aPrivacy Shield, use of Standardized Information Gathering (SIG), etc.

In various embodiments, the system is configured to scan the one or morewebpages by: (1) scanning one or more pieces of computer code associatedwith the one or more webpages (e.g., HTML, Java, JavaScript, etc.); (2)scanning one or more contents of the one or more webpages (e.g., usingone or more natural language processing techniques); (3) scanning forone or more particular images on the one or more webpages (e.g., one ormore images that indicate membership in a particular organization,receipt of a particular award etc.); and/or (4) using any other suitablescanning technique. The system may, for example, identify one or moreimage hosts of one or more images identified on the website, analyze thecontents of a particular identified privacy or cookie policy that isdisplayed on the one or more webpages, etc. The system may, for example,be configured to automatically detect the one or more vendor attributesdescribed above.

In various embodiments, the system may, for example: (1) analyze the oneor more vendor attributes; and (2) calculate a risk rating (and/orprivacy awareness score) for the vendor based at least in part on theone or more vendor attributes. In particular embodiments, the system isconfigured to automatically assign a suitable weighting factor to eachof the one or more vendor attributes when calculating the risk rating.In particular embodiments, the system is configured to analyze one ormore pieces of the vendor's published applications of software availableto one or more customers for download via the one or more webpages todetect one or more privacy disclaimers associated with the publishedapplications. The system may then, for example, be configured to use oneor more text matching techniques to determine whether the one or moreprivacy disclaimers contain one or more pieces of language required byone or more prevailing industry or legal requirements related to dataprivacy. The system may, for example, be configured to assign arelatively low risk score to a vendor whose software (e.g., and/orwebpages) includes required privacy disclaimers, and configured toassign a relatively high risk score to a vendor whose one or morewebpages do not include such disclaimers.

In another example, the system may be configured to analyze one or morewebsites associated with a particular vendor for one or more privacynotices, one or more blog posts, one or more preference centers, and/orone or more control centers. The system may, for example, calculate thevendor risk score based at least in part on a presence of one or moresuitable privacy notices, one or more contents of one or more blog postson the vendor site (e.g., whether the vendor site has one or more blogposts directed toward user privacy), a presence of one or morepreference or control centers that enable visitors to the site to optinto or out of certain data collection policies (e.g., cookie policies,etc.), etc.

In particular embodiments, the system may be configured to determinewhether the particular vendor holds one or more security certifications.The one or more security certifications may include, for example: (1)system and organization control (SOC); (2) International Organizationfor Standardization (ISO); (3) Health Insurance Portability andAccountability Act (HIPAA); (4) etc. In various embodiments, the systemis configured to access one or more public databases of securitycertifications to determine whether the particular vendor holds anyparticular certification. The system may then determine the privacyawareness score and/or vendor risk rating based on whether the vendorholds one or more security certifications (e.g., the system maycalculate a relatively higher privacy awareness score depending on oneor more particular security certifications held by the vendor). Thesystem may be further configured to scan a vendor website for anindication of the one or more security certifications. The system may,for example, be configured to identify one or more images indicatingreceipt, by the vendor, of the one or more security certifications, etc.

In still other embodiments, the system is configured to analyze one ormore social networking sites (e.g., LinkedIn, Facebook, etc.) and/or oneor more business related job sites (e.g., one or more job-posting sites,one or more corporate websites, etc.) or other third-party websites thatare associated with the vendor (e.g., but not maintained by the vendor).The system may, for example, use social networking and other data toidentify one or more employee titles of the vendor, one or more jobroles for one or more employees of the vendor, one or more job postingsfor the vendor, etc. The system may then analyze the one or more jobtitles, postings, listings, roles, etc. to determine whether the vendorhas or is seeking one or more employees that have a role associated withdata privacy or other privacy concerns. In this way, the system maydetermine whether the vendor is particularly focused on privacy or otherrelated activities. The system may then calculate a privacy awarenessscore and/or risk rating based on such a determination (e.g., a vendorthat has one or more employees whose roles or titles are related toprivacy may receive a relatively higher privacy awareness score).

In particular embodiments, the system may be configured to calculate theprivacy awareness score and/or vendor risk rating for a vendor using oneor more additional factors such as, for example: (1) public informationassociated with one or more events that the vendor is attending; (2)public information associated with one or more conferences that thevendor has participated in or is planning to participate in; (3) etc. Insome embodiments, the system may calculate a privacy awareness scoreand/or vendor risk rating for a vendor based at least in part on one ormore government relationships with the vendor. For example, the systemmay be configured to calculate a relatively high privacy awareness scorefor a vendor that has one or more contracts with one or more governmententities (e.g., because an existence of such a contract may indicatethat the vendor has passed one or more vetting requirements imposed bythe one or more government entities).

In any embodiment described herein, the system may be configured toassign, identify, and/or determine a weighting factor for each of aplurality of factors used to determine a risk rating score for aparticular vendor. For example, when calculating the rating, the systemmay assign a first weighting factor to whether the vendor has one ormore suitable privacy notices posted on the vendor website, a secondweighting factor to whether the vendor has one or more particularsecurity certifications, etc. The system may, for example, assign one ormore weighting factors using any suitable technique described hereinwith relation to risk rating determination. In some embodiments, thesystem may be configured to receive the one or more weighting factors(e.g., from a user). In other embodiments, the system may be configuredto determine the one or more weighting factors based at least in part ona type of the factor.

In any embodiment described herein, the system may be configured todetermine an overall risk rating for a particular vendor (e.g.,particular piece of vendor software) based in part on the privacyawareness score. In other embodiments, the system may be configured todetermine an overall risk rating for a particular vendor based on theprivacy awareness score in combination with one or more additionalfactors (e.g., one or more additional risk factors described herein). Inany such embodiment, the system may assign one or more weighting factorsor relative risk ratings to each of the privacy awareness score andother risk factors when calculating an overall risk rating. In thisembodiment, or in any other suitable embodiment described herein, aftercalculating a vendor risk rating for a vendor, the system mayautomatically provide the risk score for the vendor, and/or a particularproduct (e.g., software) or service associated with the vendor (e.g.,for use in a current or potential client of the vendor), for use incalculating a risk of undertaking a particular processing activity thatutilizes the vendor, software, and/or service (e.g., in any suitablemanner described herein).

In a particular example, the system may be configured to identifywhether the vendor is part of a Privacy Shield arrangement. Inparticular, a privacy shield arrangement may facilitate monitoring of anentity's compliance with one or more commitments and enforcement ofthose commitments under the privacy shield. In particular, an entityentering a privacy shield arrangement may, for example: (1) be obligatedto publicly commit to robust protection of any personal data that ithandles; (2) be required to establish a clear set of safeguards andtransparency mechanisms on who can access the personal data it handles;and/or (3) be required to establish a redress right to addresscomplaints about improper access to the personal data.

In a particular example of a privacy shield, a privacy shield betweenthe United States and Europe may involve, for example: (1) establishmentof responsibility by the U.S. Department of Commerce to monitor anentity's compliance (e.g., a company's compliance) with its commitmentsunder the privacy shield; and (2) establishment of responsibility of theFederal Trade Commission having enforcement authority over thecommitments. In a further example, the U.S. Department of Commerce maydesignate an ombudsman to hear complaints from Europeans regarding U.S.surveillance that affects personal data of Europeans.

In some embodiments, the one or more regulations may include aregulation that allows data transfer to a country or entity thatparticipates in a safe harbor and/or privacy shield as discussed herein.The system may, for example, be configured to automatically identify atransfer that is subject to a privacy shield and/or safe harbor as “lowrisk.” In this example, U.S. Privacy Shield members may be maintained ina database of privacy shield members (e.g., on one or more particularwebpages such as at www.privacyshield.gov). The system may be configuredto scan such webpages to identify whether the vendor is part of theprivacy shield.

In particular embodiments, the system may be configured to monitor theone or more websites (e.g., one or more webpages) to identify one ormore changes to the one or more vendor attributes. For example, a vendormay update a privacy policy for the website (e.g., to comply with one ormore legal or policy changes). In some embodiments, a change in aprivacy policy may modify a relationship between a website and itsusers. In such embodiments, the system may be configured to: (1)determine that a particular website has changed its privacy policy; and(2) perform a new scan of the website in response to determining thechange. The system may, for example, scan a website's privacy policy ata first time and a second time to determine whether a change hasoccurred. The system may be configured to analyze the change in privacypolicy to determine whether to modify the calculated risk rating orprivacy awareness score for the vendor (e.g., based on the change).

The system may, for example, be configured to continuously monitor forone or more changes. In other embodiments, the system may be configuredto scan for one or more changes according to a particular schedule(e.g., hourly, daily, weekly, or any other suitable schedule.). Forexample, the system may be configured to scan the one or more webpageson an ongoing basis to determine whether the one or more vendorattributes have changed (e.g., if the vendor did not renew its PrivacyShield membership, lost its ISO certification, etc.).

Exemplary Technical Platforms

As will be appreciated by one skilled in the relevant field, the presentinvention may be, for example, embodied as a computer system, a method,or a computer program product. Accordingly, various embodiments may takethe form of an entirely hardware embodiment, an entirely softwareembodiment, or an embodiment combining software and hardware aspects.Furthermore, particular embodiments may take the form of a computerprogram product stored on a computer-readable storage medium havingcomputer-readable instructions (e.g., software) embodied in the storagemedium. Various embodiments may take the form of web-implementedcomputer software. Any suitable computer-readable storage medium may beutilized including, for example, hard disks, compact disks, DVDs,optical storage devices, and/or magnetic storage devices.

Various embodiments are described below with reference to block diagramsand flowchart illustrations of methods, apparatuses (e.g., systems), andcomputer program products. It should be understood that each block ofthe block diagrams and flowchart illustrations, and combinations ofblocks in the block diagrams and flowchart illustrations, respectively,can be implemented by a computer executing computer programinstructions. These computer program instructions may be loaded onto ageneral-purpose computer, special purpose computer, or otherprogrammable data processing apparatus to produce a machine, such thatthe instructions which execute on the computer or other programmabledata processing apparatus to create means for implementing the functionsspecified in the flowchart block or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner such that the instructions stored in the computer-readable memoryproduce an article of manufacture that is configured for implementingthe function specified in the flowchart block or blocks. The computerprogram instructions may also be loaded onto a computer or otherprogrammable data processing apparatus to cause a series of operationalsteps to be performed on the computer or other programmable apparatus toproduce a computer implemented process such that the instructions thatexecute on the computer or other programmable apparatus provide stepsfor implementing the functions specified in the flowchart block orblocks.

Accordingly, blocks of the block diagrams and flowchart illustrationssupport combinations of mechanisms for performing the specifiedfunctions, combinations of steps for performing the specified functions,and program instructions for performing the specified functions. Itshould also be understood that each block of the block diagrams andflowchart illustrations, and combinations of blocks in the blockdiagrams and flowchart illustrations, can be implemented by specialpurpose hardware-based computer systems that perform the specifiedfunctions or steps, or combinations of special purpose hardware andother hardware executing appropriate computer instructions.

Example System Architecture

FIG. 22 is a block diagram of a Vendor Risk Scanning System 1000according to a particular embodiment. In some embodiments, the VendorRisk Scanning System 1000 is configured to scan one or more websitesassociated with a particular vendor to identify and analyze one or moresecurity certifications, privacy and/or cookie policies, etc. The systemmay, for example, initiate a virtual browsing session on any of the oneor more servers and/or computers described below in order to facilitatethe scanning of the one or more webpages (e.g., in order to access andthen scan the one or more websites).

As may be understood from FIG. 1, the Vendor Risk Scanning System 1000includes one or more computer networks 1150, a Vendor Risk ScanningServer 1100, a Vendor Risk Analysis Server 1200 (e.g., which may beconfigured to analyze data identified during a scan of the vendor'swebsite(s)), One or More Third Party Servers 1300, one or more databases1400 (e.g., which may be used to store data used as part of theanalysis, results of the analysis, etc.), and one or more remotecomputing devices 1500 (e.g., a desktop computer, laptop computer,tablet computer, etc.). In particular embodiments, the one or morecomputer networks 115 facilitate communication between the Vendor RiskScanning Server 1100, a Vendor Risk Analysis Server 1200, One or MoreThird Party Servers 1300, one or more databases 1400, and one or moreremote computing devices 1500.

The one or more computer networks 1150 may include any of a variety oftypes of wired or wireless computer networks such as the Internet, aprivate intranet, a public switch telephone network (PSTN), or any othertype of network. The communication link between Vendor Risk ScanningServer 1100 and Vendor Risk Analysis Server 1200 may be, for example,implemented via a Local Area Network (LAN) or via the Internet.

Conclusion

Although embodiments above are described in reference to various systemsand methods for creating and managing data flows related to individualprivacy campaigns, it should be understood that various aspects of thesystem described above may be applicable to other privacy-relatedsystems, or to other types of systems, in general. For example, thefunctionality described above for obtaining the answers to variousquestions (e.g., assigning individual questions or sections of questionsto multiple different users, facilitating collaboration between theusers as they complete the questions, automatically reminding users tocomplete their assigned questions, and other aspects of the systems andmethods described above) may be used within the context of PrivacyImpact Assessments (e.g., in having users answer certain questions todetermine whether a certain project complies with an organization'sprivacy policies).

While this specification contains many specific embodiment details,these should not be construed as limitations on the scope of anyinvention or of what may be claimed, but rather as descriptions offeatures that may be specific to particular embodiments of particularinventions. Certain features that are described in this specification inthe context of separate embodiments may also be implemented incombination in a single embodiment. Conversely, various features thatare described in the context of a single embodiment may also beimplemented in multiple embodiments separately or in any suitablesub-combination. Moreover, although features may be described above asacting in certain combinations and even initially claimed as such, oneor more features from a claimed combination may in some cases be excisedfrom the combination, and the claimed combination may be directed to asub-combination or variation of a sub-combination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the embodiments described above should not be understoodas requiring such separation in all embodiments, and it should beunderstood that the described program components and systems maygenerally be integrated together in a single software product orpackaged into multiple software products.

Many modifications and other embodiments of the invention will come tomind to one skilled in the art to which this invention pertains havingthe benefit of the teachings presented in the foregoing descriptions andthe associated drawings. While examples discussed above cover the use ofvarious embodiments in the context of operationalizing privacycompliance and assessing risk of privacy campaigns, various embodimentsmay be used in any other suitable context. Therefore, it is to beunderstood that the invention is not to be limited to the specificembodiments disclosed and that modifications and other embodiments areintended to be included within the scope of the appended claims.Although specific terms are employed herein, they are used in a genericand descriptive sense only and not for the purposes of limitation.

What is claimed is:
 1. A computer-implemented data processing method forperforming a risk assessment for a vendor, the method comprising:scanning, by one or more computer processors, one or more webpagesassociated with the vendor; identifying, by one or more computerprocessors, one or more vendor attributes associated with the vendorbased on the scanned one or more webpages, wherein the one or morevendor attributes comprise one or more security certifications that thevendor claims to hold; accessing, by one or more computer processors,one or more databases of security certifications to determine whetherthe vendor holds the one or more security certifications; accessing, byone or more computer processors, a completed privacy template, thecompleted privacy template comprising a plurality of question/answerpairings regarding the vendor; calculating, by one or more computerprocessors, a vendor risk rating based at least in part on the one ormore vendor attributes and content of the at least one of the pluralityof question/answer pairings in the completed privacy template; andtaking, by one or more computer processors, one or more automatedactions based on the vendor risk rating.
 2. The computer-implementeddata processing method of claim 1, wherein the one or more securitycertifications comprise one or more privacy shield certifications. 3.The computer-implemented data processing method of claim 1, wherein theone or more vendor attributes further comprise one or more securitypolicies implemented by the vendor.
 4. The computer-implemented dataprocessing method of claim 1, wherein the one or more vendor attributesfurther comprise one or more privacy policies for the one or morewebpages.
 5. The computer-implemented data processing method of claim 1,wherein the one or more vendor attributes further comprise one or morepotential sub processors of one or more services associated with thevendor.
 6. The computer-implemented data processing method of claim 1,wherein the one or more webpages are served by the particular vendor. 7.The computer-implemented data processing method of claim 1, wherein theone or more webpages are not served by the particular vendor.
 8. Thecomputer-implemented data processing method of claim 1, wherein scanningthe one or more webpages comprises scanning the one or more webpages fordocumentation that the vendor holds the one or more securitycertifications.
 9. The computer-implemented data processing method ofclaim 8, wherein the documentation that the vendor holds the one or moresecurity certifications comprises at least one image that is associatedwith the one or more security certifications.
 10. Thecomputer-implemented data processing method of claim 1, the methodfurther comprising: in response to determining that the vendor holds theone or more security certifications that the vendor claims to hold viathe one or more databases, confirming that the vendor holds the one ormore security certifications.
 11. The computer-implemented dataprocessing method of claim 1, wherein the one or more databases ofsecurity certifications comprise one or more public databases ofsecurity certifications.
 12. A computer-implemented data processingmethod for performing a risk assessment for a vendor, the methodcomprising: scanning, by one or more computer processors, one or morewebpages associated with the vendor; identifying, by one or morecomputer processors, one or more vendor attributes associated with thevendor based on the scanned one or more webpages, wherein the one ormore vendor attributes comprise one or more security policiesimplemented by the vendor; accessing, by one or more computerprocessors, a completed privacy template, the completed privacy templatecomprising a plurality of question/answer pairings regarding the vendor;calculating, by one or more computer processors, a vendor risk ratingbased at least in part on the one or more vendor attributes and contentof the at least one of the plurality of question/answer pairings in thecompleted privacy template; and taking, by one or more computerprocessors, one or more automated actions based on the vendor riskrating.
 13. The computer-implemented data processing method of claim 12,wherein the one or more vendor attributes further comprise one or moreawards that the vendor claims to have received.
 14. Thecomputer-implemented data processing method of claim 13, wherein the oneor more vendor attributes further comprise one or more securitycertifications that the vendor holds.
 15. The computer-implemented dataprocessing method of claim 12, wherein the one or more vendor attributesfurther comprise one or more privacy policies for the one or morewebpages.
 16. The computer-implemented data processing method of claim12, wherein the one or more vendor attributes further comprise one ormore potential sub processors of one or more services associated withthe vendor.
 17. The computer-implemented data processing method of claim12, wherein the one or more webpages are served by the particularvendor.
 18. The computer-implemented data processing method of claim 12,wherein the one or more webpages are not served by the particularvendor.
 19. A computer-implemented data processing method for performinga risk assessment for a vendor used as part of a processing activity,the method comprising: receiving, by one or more computer processors, acompleted privacy template from a vendor, the completed privacy templatecomprising a plurality of question/answer pairings regarding aparticular product or service provided by the vendor; scanning, by oneor more computer processors, one or more webpages associated with thevendor; identifying, by one or more computer processors, one or morevendor attributes associated with the vendor based on the scanned one ormore webpages, wherein the one or more vendor attributes comprise aprivacy policy associated with the one or more webpages; analyzing, byone or more computer processors, the privacy policy to identify one ormore key terms in the privacy policy related to the particular productor service that is the subject of at least one question within theprivacy template; calculating, by one or more computer processors, avendor risk rating for the vendor based at least in part on the one ormore vendor attributes, the one or more key terms in the privacy policy,and one or more question/answer pairings from the privacy template; andtaking, by one or more computer processors, one or more automatedactions based on the calculated vendor risk rating.
 20. Thecomputer-implemented data processing method of claim 19, the methodfurther comprising: monitoring the one or more webpages for one or moreupdates; in response to identifying the one or more updates, determiningwhether the one or more updates affect the one or more vendorattributes; and in response to determining that the one or more updatesaffect the one or more vendor attributes, calculating an updated vendorrisk rating based at least in part on the affected one or more vendorattributes.
 21. The computer-implemented data processing method of claim19, wherein: scanning the one or more webpages comprises scanning theone or more webpages to identify the privacy policy.
 22. Thecomputer-implemented data processing method of claim 19, wherein: theone or more vendor attributes comprise a cookie policy implemented viathe one or more webpages; and scanning the one or more webpagescomprises scanning the one or more webpages to determine one or morevendor data collection policies based on the cookie policy.
 23. Thecomputer-implemented data processing method of claim 22, wherein: theone or more vendor data collection policies relate to the particularproduct or service; and the method further comprises calculating thevendor risk rating based at least in part on the one or more vendor datacollection policies.
 24. The computer-implemented data processing methodof claim 19, wherein: calculating the vendor risk rating furthercomprises: determining one or more employee titles, employee roles, oravailable job posts with the vendor from one or more third party socialnetworking sites; and calculating the vendor risk rating based at leastin part on the one or more employee titles, employee roles, or availablejob posts with the vendor.
 25. The computer-implemented data processingmethod of claim 19, wherein: the one or more vendor attributes compriseone or more security certifications that the vendor claims to hold; andscanning the one or more webpages comprises scanning the one or morewebpages for documentation that the vendor holds the one or moresecurity certifications.
 26. The computer-implemented data processingmethod of claim 25, wherein the documentation that the vendor holds theone or more security certifications comprises at least one image that isassociated with the one or more security certifications.
 27. Thecomputer-implemented data processing method of claim 26, the methodfurther comprising: accessing, by the one or more computer processors,one or more public databases of security certifications to determinewhether the vendor holds the one or more security certifications; and inresponse to determining that the vendor holds the one or more securitycertifications via the one or more public databases, confirming that thevendor holds the one or more security certifications.
 28. Thecomputer-implemented data processing method of claim 19, the methodfurther comprising: determining that the vendor risk rating is below apredetermined threshold; and automatically initiating the processingactivity in response to determining that the vendor risk rating is belowthe predetermined threshold.
 29. The computer-implemented dataprocessing method of claim 19, wherein the one or more vendor attributesfurther comprise one or more vendor attributes that are selected from agroup consisting of: one or more awards that the vendor has received;and one or more security policies implemented by the vendor.
 30. Thecomputer-implemented data processing method of claim 19, wherein the oneor more automated actions comprise transferring the vendor risk ratingto a current or potential client of the vendor for use in assessing arisk of doing business with the vendor.